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PREFACE 

This  report,  funded  as  an  IDA  Central  Research  Project,  grew  out  of  the  authors’ 
participation  in  the  Defense  Science  Study  Group  (DSSG)  organized  by  IDA.  The  DSSG 
is  a  program  of  educaticHi  and  study  for  young  professors  of  science,  engineering  and 
mathematics  who  have  achieved  national  recognition  in  their  fields.  The  goal  of  the 
program  is  to  foster  a  long-term  interest  in  national  security  issues  among  the  DSSG 
membors  through  technical  briefings  by  officials  in  government  and  specialists  in  defense 
and  industry,  and  site  visits  to  military,  industrial  and  national  laboratory  facilities.  During 
this  program,  the  authws  developed  a  new  concept  for  the  control  of  tactical  weapons. 
Upon  completion  of  the  DSSG  program,  the  authors  continued  their  study  under  IDA 
sponsorship,  expanding  the  concept  to  strategic  weapon  systems. 


nnc  Qu. 


iii 

UNCLASSIFIED 


1  Aooesslon  For  ^  | 

HTIS  ORAJcI 
DTIC  TAB 
Unaimounced 
Ju3tlf Icatl 

aT 

□ 

□ 

on 

Bv 

_piBtribution/ 

Avallabllli 

ty  Codbs 

Diet 

r 

Avail 

Spec 

6uid/or 

ial 

UNCLASSIFIED 


(This  page  intentionally  left  Uank) 


iv 

UNCLASSIFIED 


UNCLASSIFIED 


TABLE  OF  CONTENTS 

Glossary .  “ 

I.  INTTRODUCnON .  1 

A.  General  Overview  of  AS-IS .  2 

B.  AS-IS  Implementation  f(v  SLBMs .  4 

C.  AS-IS  vs.  Conventional  PALs .  4 

D.  Report  Oi;ganization .  5 

II.  THE  AS-IS  CONCEPT .  7 

A  AS-IS  Communications  Link .  7 

B.  AS-IS  Message  Format .  10 

C  AS-IS  Enaypticn/Deciyption  Scheme .  11 

D.  AS-IS  Default  Functianiality .  13 

E.  AS-IS  Receiver  Module  Electronics .  14 

F.  AS-IS  Demonstration  Prototypes .  15 

in.  COUNTERMEASURES .  19 

A  Fbtcing  AS-IS  into  the ‘ENABLE’ State .  19 

B.  Forcing  AS-IS  into  the  ‘DISABLE’  State .  20 

C.  AS-IS  Decryption  Countermeasures .  20 

D.  AS-IS  Message  Playback  Countermeasures .  21 

E  AS-IS  Message  Jamming .  22 

V 


UNCLASSIFIED 


UNCLASSIFIED 


IV.  OTHER  AS-IS  IMPLEMENTATIONS .  25 

A.  Basic  Tactical  Implementations .  25 

1.  Tactical  Weapon  Proliferation .  25 

2.  AS-IS  Ctmfiguration  for  Tactical  We^xms .  26 

3.  Implications  of  AS-IS-Configuied  Tactical  Weapons .  29 

B.  GPS-Coupled  Implementations .  30 

V.  SUMMARY  AND  FUTURE  DIRECTIONS .  33 

References .  35 

Appendixes 


A. 

B. 

C. 


The  AS-IS  Conmunications  Concq[>t  -  >^ewgra|^  firom  a  Presentation  to  a  Red 
Team  Convened  at  IDA,  Fetxuary  19, 1992 

Red  Team  Evaluation 

Distribution  List 


Vi 

UNCLASSIFIED 


UNCLASSIFIED 


LIST  OF  FIGURES 


1. 


2. 

3. 


4. 


The  Global  AS-IS  Concept  for  Continuing  Authorization  of  Weapons 
Systems  Through  Satellite  links  to  Receiver  Modules  in  Individual  Fielded 
WeiqxMis . 

AS-IS  Implementadixi  for  NCA  Control  Over  AccidentaVUnauthoiized 
SLBM  Laches  During  Peac^ime . 

Schematic  indicating  Ueal  Signal-to-Ndse  Ratio  (dB)  Achievable  Widi 
a  Simple  1/2-Wave  D^le  Antenna  as  a  Function  of  Carrier  Frequency, 
Transmissicm  Bandwiddi,  and  Transmitta'  Power  for  a  Satellite  Transmitter 
Widi  Full  Hemisidiere  Projected  Coverage . 

AS-IS  Demonstration  Receiver  Layout . 


3 

5 


9 

16 


5 .  AS-IS  Demonstration  Transmitter  Layout .  17 

6.  AS-IS  Ccmcept:  Stinger  Implementaticm .  28 


vu 


UNCLASSIFIED 


UNCLASSIFIED 


(This  page  is  intendmally  left  blank) 


vm 


UNCLASSIFIED 


UNCLASSIFIED 


GLOSSARY 


AS-IS 

Active  Safing  and  Isolation  System 

BER 

Bit>errori:ate 

DSSG 

Defense  Science  Study  Group 

ECC 

Enor-checking  and  collection 

EM 

Electrcxnagnetic 

EMI 

Electromagnetic  interference 

EW 

Electromagnetic  Waitiire 

FARR 

Failsafe  and  Risk  Reduction  Review 

nsss 

Frequency-independent  strong  signal  suppressor 

FMA 

Foreign  militaty  aid 

FMS 

Foreign  military  sales 

GPS 

Global  Positioning  System 

MTBF 

Mean  time  between  failure 

NCA 

National  Command  Autiiority 

PAL 

Permissive-action  link 

RPAL 

Remote  permissive-actiai  link 

ISAM 

Surface-to-air  missile 

SLBM 

Submarine  launched  ballistic  missile 

SLCM 

Sea  launched  cruise  missile 

SNR 

Signal/noise  ratio 
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I.  INTRODUCTION 


The  principal  objection  against  permissive-action  links  (PALs)  in  submarine-based 
strategic  nuclear  missiles  has  traditionally  been  that  any  requirement  for  a  launch 
authorization  message  from  an  external  National  Command  Authority  (NCA)  compromises 
the  threat  posed  by  an  autonomous  vehicle  like  the  submarine.  At  present,  even  if  all 
c(Mnmunicati(Mis  assets  should  fail  in  a  conflict,  ot  if  the  ground-  and  air-based  legs  of  the 
strategic  triad  become  incapacitated,  the  autonomous  submarines  would  remain  an 
extremely  potent  nuclear  retaliatory  threat  Sulnnaiine-based  strategic  nuclear  nussiles  thus 
serve  as  a  highly-eifective  final  stabilizing  element  in  the  triad.  However,  to  achieve  this 
situation,  the  risk  of  an  unauthorized  or  accidental  missile  launch  becomes  part  of  the 
equation. 

Though  the  absence  of  PALs  in  submarine  launched  ballistic  missiles  (SLBMs)  has 
long  been  a  subject  of  some  concern,  the  willingness  to  accept  the  risk  that  this  situation 
poses  has  been  significantly  altered  by  geopolitical  changes  that  have  occurred  over  the  past 
2  years.  This  has  become  a  tcqiic  of  renewed  discussion,  and  has  recently  been  brought 
under  formal  review  by  the  Kirkpatrick  Failsafe  and  Risk  Reduction  Review  (FARR) 
Committee,  as  well  as  the  National  Academy  of  Sciences  Committee  on  International 
Security  and  Arms  Control.  Some  form  of  protective  measures  for  SLBMs  may  indeed  be 
in  the  offing.  Solutions  thus  need  to  be  explored  that  effectively  allow  some  form  of 
control  to  be  asserted  over  accidental  or  unauthorized  SLBM  launches  during  peacetime. 
However,  it  is  essential  that  any  options  being  considered  must  not  compromise  either  the 
stealth  characteristics  of  the  submarine  platfcmn  itself,  or  the  launch  autonomy  that  is 
central  to  the  submarine’s  key  stabilizing  role  in  the  strategic  triad  during  both  peace  and 
war. 

This  report  describes  a  new  concept  called  AS-IS  (Active  Safing  and  Isolation 
System)  for  a  satellite-based  remote  permissive-action  link  (RPAL)  providing  continual 
NCA  control  ctqrability  over  advanced  electronic  systems.  The  major  comptments  of  the 
AS-IS  concept  are  quite  general,  and  can  be  implemented  in  various  ways  for  specific 
strategic,  tactical,  and  commercial  qjplications.  In  the  configuraticm  described  here  for 
SLBM  use,  AS-IS  appears  to  provide  a  workable  solution  for  the  SLBM  ’’authorization 
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problem,”  while  at  the  same  time  satisfying  traditional  objections  against  the  use  of 
ctmventicHial  PALs  in  submarine-based  nuclear  strategic  missiles. 

The  AS-IS  concept  was  originally  developed  [Ref.  1]  during  the  IDA/DARPA 
Defense  Science  Study  Group  GDSSG)  1990  Summer  Study,  and  focused  primarily  on 
implementations  to  allow  control  of  large  numbers  of  tactical  weapons.  A  subsequent 
descriptitMi  [Ref.  2]  introduced  the  applicadrai  of  AS-IS  for  control  oi  SLBMs/sea  launched 
cruise  missiles  (SLCMs).  This  IDA  Central  Research  Project  Final  Report  focuses 
primarily  on  the  potential  suitability  of  AS-IS  as  a  solution  for  the  SLBM  PAL  problem, 
allowing  NCA  to  deal  with  accidental  or  unauthorized  missile  launches.^  Additional 
^plications  are  briefly  summarized  for  various  tactical  weapon  implementations,  both  for 
foreign  military  aid  (FMA)  and  foreign  military  sales  (FMS)  units,  as  well  as  for  certain 
commercial  inq)lementations  in  advanced  consumer  electronics. 

A.  GENERAL  OVERVIEW  OF  AS-IS 

In  its  simplest  form,  the  AS-IS  concept  involves  a  small  package  of  microelectronic 
receiver/amplifier/logic  drcuioy  embedded  on  board  a  weiqwn,  which  reacts  to  a  suite  of 
globally  transmitted  acritm  sequence  messages  to  provide  central  remote  control  over  the 
functional  state  of  the  wetqx>n.  The  general  idea  is  shown  schematically  in  Figure  1. 
Messages  are  continuously  transmitted  by  the  NCA  via  secure  one-way  satellite  links  to 
AS-IS  receiver  units  equipped  with  omnidirectitmal  antennas.  The  AS-IS  receivers  are 
Qrpically  embedded  deeply  within  die  on-board  atming/guidance  circuitry  of  the  weapon.  A 
unique  digital  address  assigned  to  each  individual  AS-IS  receiver  module  allows  the  NCA 
to  exocise  enable/disable  control,  or  even  funcdcmal  reprogrammability,  over  entire  classes 
of  weapons,  over  selected  groups  of  weapcms,  or  even  over  individual  fielded  weapons. 
Global  coverage  afforded  by  the  AS-IS  satellite  link  removes  the  need  for  any  physical 
access  to  the  weapon,  or  even  the  need  for  any  knowledge  of  the  weapon  location.  The 
AS-IS  units  are  strictly  passive  receivers,  and  caimot  disclose  the  presence  of  the  weiqion 
in  which  they  are  contained.  The  entire  set  of  AS-IS  module  addresses  required  to  assert 
control  over  large  numbers  of  weapons  can  be  cycled  through  in  a  very  short  time.  If  for 
any  reason  transmission  of  the  AS-IS  messages  to  the  weapon  is  internqited  or  terminated, 
the  AS-IS  unit  automatically  defaults  to  a  predetermined  state  of  functionality.  If  the 
integrity  of  die  AS-IS  unit  itself  is  in  any  way  conqiromised  or  fails,  the  weapon  also  enters 


^  The  SLBM  imidenientation  described  here  reflects  numerous  nquits  offered  during  summary  briefings 
given  to  various  agencin  over  the  past  18  months. 
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this  predetennined  default  functional  state.  AS>IS  thus  provides  the  capability  for  NCA  to 
rapidly  and  reliably  address  individual  weapons  or  groups  of  weapons  -  fielded  in 
potentially  unknown  global  locations  -  without  any  direct  physical  access,  and  alter  or 
reprogram  their  functionality. 


ENABLED  Weapon 


DISABLED  Weapon 


REPROGRAMMED  Weapon 


Figure  1.  The  Global  AS*IS  Concept  for  Continuing  Authorization 
of  Weapon  Syatema  Through  Satellite  Linke  to  Receiver  Modulee 
In  Individual  Fielded  Weapons 
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B .  AS-IS  IMPLEMENTATION  FOR  SLBMS 

The  SLBM  configuration  of  AS-IS  is  indicated  schematically  in  Figure  2.  In  this 
case,  the  predetermined  default  state  corresponds  to  an  ‘ENABLE*  mode,  in  which  full 
functionality  of  the  weapon  is  available.  In  effect,  the  missile  in  this  state  is  entirely 
unaffected  by  the  presence  of  the  AS-IS  module.  Since  the  NCA’s  UHF  transmissions  do 
not  penetrate  the  oceans,  missiles  in  their  launch  tubes  continually  remain  in  this  default 
‘ENABLE*  state.  During  peacetime,  the  NCA  would  continuously  broadcast  ‘DISABLE* 
signals  to  all  SLBM  AS-IS  addresses.  In  the  event  of  a  missile  launch,  the  AS-IS  unit  on 
board  the  missile  would  first  receive  the  encrypted  NCA  signal  at  breakwater,  and  react 
accordingly.  When  the  NCA  transmission  directs  the  missile  into  its  ‘DISABLE*  state,  the 
launched  SLBM  disarms  itself  and  aborts  its  flight  by  altering  its  trajectory  and/or  self- 
destructing.  On  the  other  hand,  during  periods  of  increased  force  readiness,  or  in  wartime, 
NCA  would  broadcast  ‘ENABLE*  signals  to  selected  SLBMs,  or  to  all  missiles,  allowing 
their  full  functionality  just  as  though  AS-IS  were  not  present  Even  if  the  NCA*s  ability  to 
transmit  the  ‘ENABLE*  codes  were  compromised,  interrupted,  or  terminated,  the  missile 
would  still  automatically  default  into  the  ‘ENABLE*  state  and  be  fully  functionaL  AS-IS 
thus  never  prevents  launch  of  an  SLBM.  Moreover,  successful  action  sequence  is  required 
only  during  peacetime  to  abort  accidental  or  unauthorized  missUe  launches. 

C.  AS-IS  VS.  CONVENTIONAL  PALS 

AS-IS,  as  summarized  above  for  q^lication  to  SLBMs,  is  in  many  ways  die  logical 
opposite  of  a  traditional  PAL.  Unlike  ctniventional  physical-access  PALs,  AS-IS  is  a 
purely  remote-access  concept.  More  importantly,  traditional  PALs  require  a  specific 
positive  acticm  sequence  to  permit  functionality  of  the  weapon.  In  contrast,  AS-IS  allows 
full  weapon  functionally  in  the  absence  of  any  action  -  a  positive  AS-IS  actitm  sequence  is 
needed  only  if  the  weapon  functionality  is  to  be  blocked.  Conventicmal  PAL  concepts 
involve  a  weak  link  through  an  external  launch  authorization  message  from  the  NCA. 
AS-IS,  on  the  other  hand,  allows  launch  even  under  a  catastrophic  failure  of  the  NCA 
transmission  link.  AS-IS  dius  fully  maintains  the  launch  autonomy  of  the  SLBM  platfoim 
during  wartime,  which  is  key  to  the  submarine*s  principal  role  in  die  strategic  triad,  as  well 
as  preserving  the  stealth  characteristics  of  the  submarine  itself.  At  the  same  time,  AS-IS 
effectively  introduces  a  aqiability  for  NCA  to  assert  control  over  accidental  or  unaudiorized 
SLBM  launches  during  peacetime  or  in  lower  states  of  fence  readiness. 
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Flgura  2.  AS-IS  lmpl«m«ntatlon  for  NCA  Control  Ovor  AccldentalAlnauthorlzod 

SLBM  Launchot  During  Paaeatima 


D.  REPORT  ORGANIZATION 

This  report  is  organized  as  follows.  Section  n  introduces  details  of  the  general 
AS-IS  concept  and  also  describes  a  particular  strawman  iiiq)lementation  suitable  for 
maintaining  RPAL  ctmtrol  over  SSBN-launched  strategic  nuclear  weapons.  Sectitm  ID 
discusses  certain  potential  countermeasures  to  the  SLBM  implementatitm  of  AS-IS,  and 
describes  how  various  AS-IS  features  ate  iroant  to  address  them.  Many  of  these 
countermeasure  solutions  are  also  applicable  beyond  the  SLBM  application.  In  fact, 
though  AS-IS  is  currently  being  proposed  primarily  as  a  solutimi  to  the  PAL  problon  for 
SLBMs/SLC!Ms,  numerous  odier  iqjplicaticMis  exist  for  which  diis  c(mcq>t  provides  unique 
capabilities,  including  both  military  and  commercial  scenarios.  Some  of  these  are 
discussed  in  Section  IV.  These  include  the  implonentation  of  AS-IS  for  (XHimd  of  tactical 
weapons,  and  offer  novel  capabilities  for  remote  control  over  the  functionality  of  certain 
classes  of  widely  dispersed  weapons  often  found  in  Third  World  countries  as  well  as  in 
terrorist  arsenals.  Section  V  summarizes  some  of  the  points  given  here,  and  briefly 
discusses  future  directirms  in  which  the  AS-IS  concept  developmoit  is  progressing. 


5 

UNCLASSIFIED 


UNCLASSIFIED 


(This  page  is  iotentionally  left  blank) 


6 

UNCLASSIFIED 


UNCLASSIFIED 


II.  THE  AS-IS  CONCEPT 


AS-IS  is  a  very  general  concq>t,  providing  for  leinote  ann/disann  crmtiol  OTiemote 
leprogrammability  of  hi^-thieat  tactical  and  strategic  weqxns,  including  both  nuclear  and 
non-nuclear  as  well  as  other  ntmconventional  weaptms.  This  secticm  gives  a  description  of 
various  components  of  the  AS-IS  ctmcept  For  the  purposes  of  ctmcrete  discussion,  a 
specific  strawman  omfiguration  of  these  comptments  is  given  for  the  SLBM  aiq}lication 
described  above.  A  technical  assessment  of  the  feasibility  of  these  various  embodiments  is 
also  included. 

A.  AS-IS  COMMUNICATIONS  LINK 

Continuing  authorization  of  weapons  with  installed  AS-IS  modules  occurs  over 
digital  satellite  links,  which  relay  encrypted  NCA  messages  fimn  one  or  more  transmission 
sites  to  weapons  in  the  field.  Uplink  antennae  are  ground-  and/or  aircraft-based.  A 
minimum  of  three  geosynchronous  satellites  inovide  the  primary  AS-IS  communications 
relay  link  fix'  authorization  commands,  and  are  required  fix  ctmtinuous  global  coverage 
within  the  relevant  latitudes.  Lower  earth-orbit  satellites,  such  as  the  existing  1.6  GHz 
Navstar  Global  Positioning  System  (GPS)  satellites,  might  also  be  usable  as  a  primary  or 
secmidary  relay  Unk,  providing  true  global  coverage.^  The  global  satellite  link  obviates  the 
need  for  any  physical  access  to  control  the  weapon,  or  even  the  need  to  know  where  die 
weapon  is  globally  located.  No  knowledge  of  the  fixation  cf  either  die  weqxm  or  the 
launch  platform  is  required  in  order  to  address  the  AS-IS  module. 

A  clock  dtcuit  internal  to  the  AS-IS  module  enables  the  receiver  and  decoding 
electronics  to  detect  and  update  the  wespon  status  periodically^  after  a  predetermined  update 
time  expires  (e.g.,  once  every  few  secmids).  The  AS-IS  units  are  stricdy  recrive-<xily  -  no 
response  signals  ate  broadcast  from  the  weapon  back  to  NCA,  and  no  significant 
electromagnetic  radiation  is  emitted  fiom  the  electromagnedc  interference  (EMI)-shiekled 


1  Existuf  DSCS  aiellites.  as  well  as  the  newer  jam-iesistattt  Milstar  system,  mi^  be  snitdile  fix 
providinf  the  primaiy  AS-IS  hidts. 

2  llifi  lethnes  the  AS-IS  nxMhile  power  leqimement  (see  Sectkm  ILE).  Aheniativdy.  the  AS-IS  module 
can  be  ooafignnd  in  a  lisien-always  mode  indqieadent  of  any  huenial  dodL 
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module.  The  system  is  entirely  passive  and  cannot  electronically  disclose  the  presence  of 
the  weapon  or  its  launch  platform.  The  message  is  received  by  the  AS-IS  module  via  a 
confcmnal  antenna  integrated  into  the  wet^xxi  housing.  A  siiiq)le  energy-per-bit  analysis  of 
the  message  integrity  in  the  presence  of  noise  allows  an  assessment  of  various 
communications  link  parameters.  A  single  geosynchronous  relay  satellite  is  assumed  in  the 
field  of  view,  with  10-50  watt  transmitting  power  in  the  relevant  AS-IS  channel,  directed 
into  full  hemisphere  eardi  coverage.  The  typical  receiver  noise  power  is  taken  as  kT  4  x 
lO*^^  J.  To  obtain  a  conservative  estimate  for  the  communication  link  integrity,  a  simple 
half-wave  dipole  antenna  is  assumed  at  the  receiver.^  The  resulting  ideal  message 
signal/noise  ratio  (SNR)  as  a  function  of  transmitter  power,  bandwidth,  and  carrier 
frequency  is  shown  in  Figure  3.  Note  that  for  many  applications  involving  a  relatively 
small  number  of  AS-IS-equipped  weapons  and/or  infrequent  message  repetition  (such  as  in 
the  SLBM  problem),  the  system  bandwidth  can  essentially  be  made  arbitrarily  small  to 
yield  acceptable  levels  of  transmissicm  integrity.  Messages  are  continuously  broadcast  to 
all  weapons  (m  a  list  maintained  by  the  NCA.  The  bandwidtii  is  determined  by  the  total 
number  of  AS-IS  module  addresses  on  this  list  and  the  desired  message  repetition  period. 
A  shtHt  repetition  period  permits  rapid  response,  while  a  longer  period  allows  for  a  lower 
syston  bandwidth.  For  n  modules  receiving  L-ttitpaclmts,  the  system  bandwidth  bw  is  bw 
=  nl/T  Hz,  where  T  is  the  typical  message  rqietititm  period  in  seconds.  Of  course,  this 
repetition  poiod  need  not  be  tiie  same  for  all  modules  -  it  may  be  desirable  to  update  some 
critical  units  more  frequently  than  others. 

As  Figure  3  indicates,  it  is  desirable  to  minimize  the  bandwidtii  requirements  and 
carrier  fiequoicy  to  maximiae  tile  message  integri^.  At  low  SNR  levels,  a  relatively  large 
number  of  error-checking  and  collection  (JECQ  bits  can  be  used  to  recover  the  message.^ 
Link  qualities  better  tiian  10  dBqipear  achievable  widi  carrier  frequencies  in  the  range  of 
several  hundred  MHz  to  about  1  GHz  (C-band),  and  for  bandwidths  up  to  about  a  MHz. 
For  purposes  of  a  conservative  configuration,  the  strawman  system  will  be  assumed  to 
consist  of  a  50  watt  transmitter  operating  at  1  GHz  with  a  125-kHZ  bandwidth.  Lower 
carrier  frequencies  and  potentially  narrower  bandwidths  can  produce  better  than  20  dB 


^  A  phased  nay  receiver  MiBiina  (Ref.  3]  may  provide  for  higher  link  ini^ities,  but  the  leqiiisiiBsigDal 
processing  may  be  excenive  for  many  AS-IS  qifdications. 

^  Moreover,  in  a  defimlt  'ENABLE  implenientation  like  die  SLBM,  it  may  not  be  essential  to  recover 
every  valid  transmission  -  only  one  v^  'DISABLE'  transmission  relatively  eariy  in  the  missile  ffight 
is  needed  acoonqdhh  the  abort  tsA. 
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signal  quality  with  lower  power  transmitters.  For  the  SLBM  application,  acceptable 
configurations  exist  with  better  tfuui  50  dB  link  integrity. 


1/2-WAVE  LENGTH 

ISm  1.5  m  15  cm 


50 


1.5  cm 
”1 - 


Increasing 
Transmitter 
Power/  Bandwidth 


30  U 


SNR 

(dB) 


10  L 


-10  L 


-30 


10MHz  100MHz  1GHz 

CARRIER  FREQUENCY 


10  GHz 


Figure  3.  Schematic  indicating  Meal  SignaK-to-Nolse  Ratio  (dB)  Achievable  with 
a  Simple  l/2*Wave  Dipole  Antenna  ae  a  Function  of  Carrier  Frequency, 
Tranemleelon  Bandwidth,  and  Tranamitter  Power  for  a  Satellite  Transmitter  With 

Full  Hemisphere  Profected  Coverage 


Weiqxms  on  the  NCA’s  transmission  list  are  addressed  in  randcxn  sequences.  This 
provides  for  increased  security  and  also  ensures  duu  on  average,  eadi  module  will  detect  its 
address  halfway  through  the  message  period.  The  latter  decreases  the  AS-IS  power 
requimnents  (see  Section  HE)  by  approximately  a  factor  of  two,  ance  the  AS-IS  receiver 
and  anqriifier  are  only  ambled  up  to  die  time  when  the  local  unit  is  addressed.  TheNCA’s 
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list  can  be  reconfigured  at  will.  In  the  strawman  configuration  5,000  fielded  weapons^  can 
be  continuously  supervised  if  all  their  AS-IS  modules  were  to  be  typically  addressed  once 
every  10  seconds;  over  50,000  weapons  can  be  controlled  on  a  2-ininute  cycle.  More 
weapons  could  be  controlled  if  the  aggregate  message  repetititm  period  is  increased,  while 
still  maintaining  the  short  repetititm  period  for  critical  strategic  weapons  such  as  the 
SLBMs.  In  addition  to  discretely  addressing  individual  AS-IS  modules  (e.g.,  a  particular 
SLBM  (Ml  a  particular  submarine  launch  platfcxm),  a  hierarchical  address  structure  allows 
NCA  to  assert  enable/disable/reprogram  control  over  groups  of  modules  having  ctMomon 
aAityss  fragments.  Broadcast  of  a  single  command  can  then  control,  for  example,  all 
missilfts  on  a  certain  submarine  launch  platform,  or  all  missiles  aboard  a  given  group  of 
submarines.^ 

Transmission  over  the  satellite  link  occurs  via  secure  (Mie-way  ccMnmunication  fimn 
NCA  to  the  AS-IS  receiver.  The  encrypted  message  structure  is  described  in  Section  n.B. 
Message  encryption  occurs  at  the  NCA;  decryption  occurs  in  the  AS-IS  module  on-board 
the  weapon.  Several  implementations  of  time-encoded,  moving-lock,  future-key 
encryption/decryption  systems  appear  capable  of  maintaining  message  integrity  and 
providing  for  secnire  message  transmission.  A  strawman  encrypticm/decrypticMi  scheme  of 
this  type,  ccnqiatible  with  other  aspects  of  the  AS-IS  syston  described  here,  is  presented  in 
Secti(Mi  n.c. 

B.  AS-IS  MESSAGE  FORMAT 

For  purposes  of  discussion,  the  length  of  the  AS-IS  message  in  the  present 
strawnum  ^stem  is  256  bits.  These  are  comprised  of  192  data  bits  and  64  parity,  ECC  and 
reserved  bits.*^  The  192  data  bits,  which  (XMXiprise  the  remainder  of  the  AS-IS  message, 
provide  for  up  to  2^^  (iiKne  than  6  x  10^'^)  unique  AS-IS  nxxiule  digital  address  codes. 
The  majority  of  this  data  field  is  reserved  for  the  missile  address.  The  remainder  is  the 
acti(Mi  sequoice  and  subsequoit  decryptXMi  informaticMi.  Each  AS-IS  nxxiule  decrypts  tiie 
incoming  256-bit  message  packets,  and  compares  the  decrypted  address  to  the  local  noodule 


^  Thii  number  is  aboot  an  order  of  magnitude  larger  than  the  current  total  number  of  SLBM*.  coosiitiin 
of  loughly  ISO  POMkkmC-Ss,  400  Trident  1  C*4s,  and  100  Trident  2  D-Ss. 

^  Imptementation  of  ‘UNIVERSAL-DISABLE'  and  'UNIVERSAL-ENABLE'  codes,  tecopized  by  all 
nKMloles,  would  allow  further  reduction  in  the  system  bandwidth  requirements  (with  attendant 
ini|xovements  in  message  int^ty)  during  noininalpeacetirne  or  warthneoperatioos. 

The  64  |«riy,  ECC,  and  reserved  bits  are  adequate  to  recover  the  true  AS-IS  message  under  condilions 
of  relati^  poor  transmission  faulty  (see  Section  ILA) 
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address.  If  a  match  occurs,  the  non-address  portion  of  the  192-bit  data  field  is  then 
decrypted  to  ascertain  authorization,  obtain  future  decryptitm  key  information,  and 
determine  the  desired  weapon  action  sequence. 

In  the  simplest  implementations,  the  AS-IS  action  sequence  information  would  be 
comprised  of  a  single  bit,  allowing  ’ENABLE/DISABLE*  actions  only.  This  capability 
would  be  adequate  for  the  SLBM  appUcatitm.  During  peacetime,  or  in  appropriately  low 
states  of  force  readiness,  the  action  sequence  bit  would  be  continually  set  to  ‘DISABLE’, 
causing  any  launched  missile  to  disarm  itself  and  terminate  its  flight  In  higher  states  of 
readiness,  the  action  sequence  bit  can  be  set  to  ‘ENABLE’  for  all  SLBM  addresses  or  for 
any  subset  of  missiles,  including  individual  SLBMs.  Additional  capabilities  can  be  made 
available  through  addititmal  acticm  sequence  Ints.  For  exanq)le,  a  second  bit  could  be  set  to 
select  from  a  ‘DESTRUCT/ABORT’  option.  After  disarming  itself  in  response  to  the  first 
bit,  the  missile  could  then  be  made  to  either  self-destruct,  or  to  merely  abort  its  trajectory. 
Depending  on  the  level  of  functionality  desired  for  any  given  application,  the  particular 
action  sequence  could  be  selected  from  any  of  a  whole  menu  of  options  -  just  8  bits  in  the 
action  sequence  fragment  of  the  AS-IS  message  allows  for  256  different  actions  to  be 
offered. 

Aside  from  the  address  and  action  sequence  bits,  the  remainder  of  the  192  data  bits 
cmitain  the  future  decryption  key  information.  Details  of  the  moving-lock,  future-key 
encryption/decryption  system  are  given  in  Section  C  below. 

C.  AS-IS  ENCRYPTION/DECRYPTION  SCHEME 

It  is  desirable  to  provide  a  robust,  flexible  operational  environment  where  AS-IS- 
protected  weapons  do  not  have  to  ccmtinually  listen  to,  or  handshake  with,  the  NCA. 
Weapon  storage  and  transportation  should  not  be  subject  to  a  requirement  of  receiving 
external  messages.  A  simplistic  way  of  achieving  this  would  be  to  continually  broadcast 
messages  whose  encryption  key  and  format  remain  constant.  A  weapon  with  a  factory- 
installed  decryption  key  would  then  be  able  to  successfully  decipher  the  message  at 
arbitrary  times.  However,  there  are  several  drawbacks  to  this  simple  approach,  two  of 
which  are  serious.  The  first  is  that  an  entire  stream  of  messages  could  be  passively 
recorded  at  any  location,  using  a  simple  receiver  and  broad-band  tape  recorder.  At  a  later 
date,  the  message  stream  could  then  be  played  back  in  the  vicinity  of  the  weiqxrn  in  an 
electromagnetic  (EM)  shielded  environment,  which  will  generate  a  guaranteed  weapon 
action  based  on  the  status  of  die  message  at  the  time  of  recording.  A  second  proUem  is  duu 
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repetitive  broadcast  of  a  short  (e.g.,  256-bit)  constant  message  provides  more  opportunity 
to  compromise  or  fuUy  breach  message  security. 

To  avdd  these  problems,  yet  maintain  flexible  receiver  operations,  a  variable,  time- 
sensitive,  encryption/decryption  scheme  is  proposed.  The  key  required  to  decode 
messages  on  board  die  AS-IS  module  is  comprised  of  two  halves,  somewhat  analogous  to 
public/private-key  systems.  One  portion  of  the  key  is  factory-installed  in  the  AS-IS 
module.  The  remainder  of  the  key,  together  with  a  short  field  containing  the  encrypted 
current  time,  is  transmitted  along  with  the  authtnization  message  to  the  remote  AS-IS- 
equipped  weapon.  The  AS-IS  module  decrypts  the  new  message  with  an  old  decryption 
key,  received  at  some  prior  time,  as  discussed  below.  The  current  message  is  then  parsed 
for  fields  that  delineate  the  new  decryption  key.  new  soft  unit-address,  weapon- 
authorization  and  status  commands,  and  the  current  time.  The  received  message  is 
considered  to  be  valid  if  the  fields  are  properiy  formatted,  and  the  difference  between  the 
received  time-field  and  an  on-board  clock  is  within  a  prescribed  tolerance.  If  the  temporal 
error  is  too  large,  it  is  presumed  that  an  ‘old*  message  was  received,  and  the  weapon  will 
enter  its  default  state. 

The  new  key  will  be  used  to  decrypt  the  next  message.  Since  message  receipt 
occurs  unpredictably,  the  key  remains  valid  up  to  the  next  transmission.  Once  used,  it  is 
deleted  and  replaced  by  the  new  key.  The  remotely  transmitted  key  is  a  member  of  an 
undepletable  set  of  valid  keys.^  Once  a  key  is  used,  it  is  deleted  from  that  set  Thus,  even 
though  the  encryption  of  messages  may  change  on  a  cycle-by-cycle  basis  (e.g.,  every 
2  minutes),  a  valid  key  can  successfully  decode  the  message  the  next  time  the  AS-IS 
module  begins  listening,  even  though  that  time  is  non-determiiustic  from  a  system 
perspective  and  multiple  k^s  may  have  been  issued  in  the  interim. 

The  address  portion  of  the  message  format  can  be  identified  in  the  incoming  signal 
without  excessive  difficulty.  A  code-breaking  effort  is  therefore  likely  to  start  with  that 
particular  bit-field.  To  mate  that  activity  significantly  more  difficult,  ntm-stationary  ‘soft’ 
virtual-addresses  are  used.  These  virtual  addresses  are  non-unique  in  that  they  can  be 
mathematically  transformed  into  a  single  logical  address.  This  allows  the  address  field  to 
be  variable,  yet  not  time  sensitive.  Internal  to  an  AS-IS  noodule,  tiie  complete  unit  address 
is  formed  by  combiiung  the  virtual  field,  encrypted  and  transmitted  by  the  NCA,  with  a 


*  The  ratio  of  invalid  to  valid  keys  can  be  made  practically  infinite,  while  still  keqring  the  number  Of 
valid  keys  essentially  infinite  (see  Section  n.Q. 
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factory-installed  ‘hard’  address  held  within  non-volatile  AS-IS  registers.  The  virtual 
addresses  that  are  received  are  continually  decrypted,  transformed,  and  compared  to  the 
current  address.  If  a  match  occurs  (and  the  time-field  is  within  error-bounds),  the  message 
is  subsequently  decoded  and  acted  upon,  along  widi  updating  the  decryption  key. 

D.  AS-IS  DEFAULT  FUNCTIONALITY 

If  a  valid  AS-IS  message  is  not  received  by  the  module  within  a  prescribed  update 
time,  the  module  defaults  into  a  predeteimined  state.  In  the  case  of  SLBMs,  this  default 
would  be  the  ‘ENABLE’  state.  In  this  ‘ENABLE’  state,  the  missile  functionality  is  entirely 
the  same  as  if  the  AS-IS  module  were  not  present  in  the  weapon.  Consequently,  if  the 
NCA  transmissions  are  interrupted  or  terminated  for  any  reason,  or  if  the  satellite  link  is  in 
any  way  compromised  (e.g.,  through  failure  of  the  NCA  satellite  link,  jamming  of  the 
AS-IS  channel,  etc.),  autonomous  control  of  the  weapon  is  returned  to  the  submarine  to 
pomit  its  full  functional  use. 

Typically,  RF  transmissions  do  not  penetrate  the  seas  to  any  useful  depth.  Thus 
AS-IS-equipped  SLBMs  on  board  a  submerged  launch  platform  would  not  receive  any 
NCA  messages,  and  would  therefore  constantly  be  in  the  default  ‘ENABLE’  state.  The 
presence  of  AS-IS  aboard  submarine-based  missiles  at  sea  does  not  interfere  with  the 
ability  to  launch  the  weapons.  In  the  event  of  a  missile  launch,  the  first  opportunity  for 
AS-IS  message  receipt  occurs  immediately  on  breakwater.^  Upon  receipt  of  a  valid 
message,  the  AS-IS  module  reacts  accordingly.  In  peacetime,  ‘DISABLE’  signals  would 
presumably  be  broadcast  continuously,  causing  any  accidental  or  unaudiorized  launch  of  a 
weapon  to  be  terminated  via  the  missile  entering  a  preset  disable  sequence,  in  which  it 
disarms  and  aborts  its  flight  by  altering  its  trajecttny  and/or  self-destrocting.  On  the  other 
hand,  during  various  states  of  readiness,  or  in  wartime,  ‘ENABLE’  signals  would  be 
transmitted  either  to  selected  groups  of  weapons  or  to  all  weapons.  In  the  ‘ENABLE’  state 
the  missile  functionality  is  entirely  unaffected  by  the  presence  of  the  AS-IS  module. 
Should  the  NCA  transmissions  fail  to  reach  the  module  fOT  any  reason,  the  weapon  sinqrly 
defaults  into  the  ‘ENABLE’  state  and  remains  fully  functional.  AS-IS  thus  effectively 
prevents  unauthorized/accidental  missile  launches  during  peacetime,  while  its  default 


^  For  the  minimum  1-aecond  address  cyck  period  needed  to  control  all  current  SLBMs  with  the  Systran 
configuration  described  in  Section  ILA,  the  AS-IS  module  would  typically  receive  die  encr^xed  NCA 
signal  before  die  missUe  tail  leaves  the  water. 
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‘ENABLE’  capability  fully  maintains  the  autonomy  and  stealth  characteristics  of  the 
submarine  platform  during  both  peace  and  war. 

E.  AS-IS  RECEIVER  MODULE  ELECTRONICS 

The  AS-IS  module  electronics  are  comprised  of  a  receiver,  an  amplifier  unit,  a 
decryption  processor,  and  an  action  sequence  logic  unit^^^  The  complete  module  is 
compact,  occupying  roughly  10  cubic  inches.  In  a  typical  application,  the  module 
electronics  themselves  might  be  physically  distributed  and  deeply  integrated  into  the 
guidance  and  fire-control  circuitry,  even  collocated  in  the  same  circuit  dies,ii  so  that  the 
entire  weapon  would  be  rendered  inoperative  by  any  attempt  to  remove  the  AS-IS 
electronics.  Alternatively,  a  separate,  hermetic,  monolithic  AS-IS  receiver  module  could 
also  be  made  virtually  tamper-proof.  Environmental  sensors  could  be  implemented  in 
applications  such  as  SLBMs,  so  that  tampering  generates  a  destruct  current  pulse  that 
permanently  disables  the  functionality  of  the  weapon,  or  permanently  sets  the  weapon  into 
its  default  state. 

The  AS-IS  module  requires  roughly  10  watt  operating  power  during  listen  mode, 
and  approximately  50  mW  in  standby.  Power  is  supplied  either  by  the  host  weapon  or 
from  a  separate  lithium  battery  housed  together  with  the  AS-IS  module.  Associated  with 
the  hardware  module  is  an  omnidirectional  antenna.  The  antenna  itself  is  compact  and 
inexpensive,  and  could  be  implemented  with  conformal  microstrip  technology  [Ref.  3]  and 
integrated  into  die  missile  housing.  Signal  processing  electronics  to  perform  decrypticm  are 
housed  within  the  AS-IS  module  cm  board  the  missile  itself. 

At  a  minimum,  AS-IS  nxxlule  reliability  can  be  expected  to  be  similar  to  other 
electroruc  mil-spec  circuitry  with  cotrqrarable  levels  of  functionality.  Based  on  a  very 
approximate  gate  count  for  the  AS-IS  module,  the  mean  time  between  failure  (MTBF)  can 
be  projected  to  lie  in  the  range  of  50  -  500  years.  Although  this  likely  exceeds  the 
operational  lifetime  of  the  weapon,  the  hardware  and  electrical  support  systems,  including 
leads,  contacts,  antenna,  etc.,  often  prove  to  be  the  more  critical  factor  in  determirung  the 
overall  MTBF.  A  realistic  assessment  of  the  reliability  and  MTBF  of  these  components 
remains  to  be  perfcmned. 


If)  A  pnxtf-of-concqx  module,  having  most  of  the  key  AS-IS  concqx  functioiialities,  has  been  built  for 
demonstration  pioposes  and  is  described  in  Section  ILF. 

In  the  SLBM  application,  well  as  in  other  retrofit  apidications,  AS-IS  modules  would  presumaUy 
be  placed  into  existing  missile  hardware,  precluding  sudi  deep  physical  int^ration  with  on-board 

electronics.  The  nature  of  the  SLBM,  hoover,  makes  (his  level  oi  integration  less  cnidal. 
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F.  AS-IS  DEMONSTRATION  PROTOTYPES 

To  illustrate  the  operatitmal  features  of  AS-IS,  a  simple  hardware  demonstrator  was 
designed  and  fabricated.  This  system  is  comprised  of:  (1)  an  electronic  unit  that  simulates 
the  key  relevant  functions  of  the  NCA  message  format  and  transmit-uplink  facility,  (2)  a 
physically  separate  electronic  unit  that  simulates  the  key  satellite  functions 
(receive/decode/shift/encode/transmit),  and  (3)  two  AS-IS  receiver  modules.  The  message 
is  transmitted  optically  over  a  line-of-sight,  pulse-width  modulated,  infrared  carrier.  The 
message  length  is  short  -  16  bits  -  with  simple  encryption  selectable.  The  satellite  accepts 
the  encrypted  uplink,  decrypts,  and  re-encrypts  the  downlink.  The  transmitter  and  receiver 
layouts  are  shown  roughly  to  scale  in  Figures  4  and  S. 

The  transmitter  sends  ‘ABLE/DISABLE’  commands  to  two  independent  AS-IS  units.  The 
messages  may  be  sent  either  ‘plain-text*  or  in  encrypted  form,  and  a  ‘UNIVERSAL- 
DISABLE’  feature  is  included  to  over-ride  the  current  messages  and  disarm  all  AS-IS  units 
with  a  single  action.  Each  receiver  detects  and  decrypts,  if  appropriate,  the  AS-IS 
message-stream.  When  the  unit  address  is  detected,  the  ‘ABLE/DISABLE*  action  code 
then  updates  the  local  module  status.  An  ‘arm/fire*  button  and  ‘weapon-away’  light  are 
used  to  simulate  the  key  elements  of  an  actual  firing  sequence.  If  the  AS-IS  module  is  in 
the  ‘ENABLE’  state,  the  weapon-away  light  will  illuminate  when  the  fire-button  arms  and 
launches  the  ‘weapon’.  Otherwise,  the  light  remains  off.  If  a  tiKxlule  does  not  receive  a 
valid  ‘NCA’  message  within  10  seconds  of  a  previous  valid  message,  a  ‘fail-safe’  indicator 
light  will  announce  that  the  unit  has  entered  its  default  state.  In  these  demonstration  units, 
which  are  meant  to  simulate  the  implementation  of  AS-IS  in  tactical  weapons,  the  default 
state  is  set  to  ‘DISABLE’.  In  this  state  the  weapon  is  incurable  of  being  ‘armed’.  The  AS- 
IS  receiver  will  remain  in  the  default  state  for  a  minimum  period  of  15  seconds,  after  which 
time  receipt  of  a  valid  NCA  message  will  bring  it  out  of  the  default  state.  A  ‘status  lock’ 
button  and  indicator  are  used  to  illustrate  a  tactical  operational  mode  of  AS-IS,  where  a 
current  status  may  be  locked  in  and  maintained,  independent  of  external  messages.  This  is 
demcmstrated  by  remotely  sending  an  ‘ENABLE’  conunand  to  either  (or  both)  of  the  AS-IS 
receivers,  then  locking  status  on  the  receiver,  and  subsequently  failing  to  send  a  valid 
message  (typically  achieved  by  blocking  the  infrared  carrier).  During  the  status-lock  period 
(20  seconds),  it  is  doixrnstrated  that  the  ‘weapon’  can  be  ‘armed’  and  ‘fired’  at  will 


See  Section  II.A.2  for  additional  AS-IS  functionalities  appropriate  for  tactical  weapons 
impiementations. 
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AS-IS  Message  on  IR  Carrier  from  Satellite 

h 
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AS’IS  Message  IR  Uplink  to  Satellite 


=  Toggle  Switch 


=  Grecn/Red  LED 


Figure  5.  A8«IS  Dtmonstration  Transmnttr  Layout 
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However,  once  the  status-lock  poiod  expires,  the  weapon  automatically  enters  its  default 
state  unless  or  until  a  valid  message  permitting  the  weqxm  to  be  armed  is  received. 

The  four  AS-IS  demonstration  modules  (transmitter,  satellite,  and  two  receivers) 
are  battery  powered,  fully  portable,  and  fit  in  a  small  briefcase.  The  demonstration  is 
generally  run  tm  a  table  with  1-3  meters  separation  between  the  transmitter,  satellite, 
and  receivers.  The  uplink  (transmitter-to-satellite  channel)  is  optically  bore-sighted  to 
simulate  tiie  directional  character  of  this  link,  while  the  downlink  (satellite  relay  to  multiple 
*ground-based’  units)  is  wide-field. 
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III.  COUNTERMEASURES 

The  following  section  examines  certain  approaches  that  might  be  used  as 
countermeasures  against  the  AS-IS  concept  described  above.  This  is  not  meant  to  be  an 
exhaustive  discussicm  of  countermeasure  possiUlides,  but  to  describe  how  various  AS-IS 
features  are  meant  to  defeat  some  typical  measures.  Owing  to  the  logical  differences 
between  AS-IS  and  conventional  PALs,  countermeasures  for  this  type  of  system  differ 
somewhat  from  those  traditionally  ctmsidered.  In  the  simplest  SLBM  inq>lementati<m,  at 
any  given  time  the  NCA  is  broadcasting  either  die  ‘DISABLE*  code  or  the  ‘ENABLE’ 
code,  and  a  given  weiq[>on  is  initially  either  in  its  ^ipropriate  NCA-directed  state  or  in  its 
default  ‘ENABLE*  state.^  It  is  useful  to  organize  potential  countermeasures  along  these 
distinctions.  Similar  classifications  can  be  made  fOT  various  tactical  inqiilementations,  and 
many  of  the  same  counter-countermeasures  discussed  below  also  apply  to  those  cases. 
Additional  AS-IS  features  that  become  relevant  for  dealing  with  potratial  countermeasures 
in  various  tactical  i^licaticms  are  discussed  in  Section  IVA.2. 

A.  FORCING  AS-IS  INTO  THE  ^ENABLE’  STATE 

In  diis  situation,  NCA  is  broadcasting  ‘DISABLE*  codes,  as  would  ^icaUy  be  die 
case  during  peacetime.  The  objective  then  would  presumably  be  to  keep  one  or  more 
weapons  in  the  ‘ENABLE*  state  after  launch  to  permit  an  unauthorized  peacetime  missile 
flight^  The  weiqxin  can  be  kept  in  this  state  quite  readily  sinqily  by  interrupting  the  NCA 
transmission  link,  thereby  engaging  die  default  ‘ENABLE*  state  of  die  AS-IS  unit  Any  of 
numerous  means  for  interrapting  transmissitms  fmn  the  NCA  site,  or  at  the  AS-IS  relay 
satellites,  can  be  effectively  removed  by  a  sufficiendy  redundant  and  distributed  network  of 
transmission  sites  and  relay  satellites.  At  the  missife,  actions  aimed  at  incapacitating  the 


^  The  defiuilt  DISABLE'  state  is  not  relevant  to  die  SLBM  qipUcation,  as  described  in  Sectkn  ILE. 
However,  this  definlt  mode  becomes  applicaUe  to  certain  tactical  weapon  inqdementatioiis  oi  the  AS- 
IS  concept,  and  genemies  an  entirely  different  set  of  coonieiroeasare  approaches.  Some  of  these,  in 
tun,  create  a  need  for  various  specialized  AS-IS  features,  such  as  a  cwreat-state  lock-in  period,  not 
qjplicabie  to  the  SLBM  implementttion.  TTieae  are  discussed  in  Section  IV  A2. 

2  SLBMs  equqiped  with  AS-IS  are  continually  in  their  default  'ENABLE  state  triien  in  their  launch 
tubes,  and  dins  AS-IS  always  pennits  an  SLBM  to  be  launched.  Ihe  NCA  DISABLE'  tiaasmiasions 
during  peacetime  only  mieiTnpt  the  missile's  flight  aftu  breakwater. 
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internal  AS-IS  circuitry  within  the  housing  to  drive  it  into  the  default  state  would  generally 
require  physical  access  to  the  missile  interim  ^  Attempts  to  sever  the  intenud  connections 
between  the  AS-IS  antenna  (integrated  into  the  missile  housing)  and  the  primary  AS-IS 
circuitry  from  outside  the  missile  would  typically  require  extremely  high  EM  or  current 
pulses/  These  would  presumably  need  to  be  ai^lied  while  die  missile  is  in  its  launch  tube. 
Anotho'  approach  would  be  to  simply  EM-shield  the  integrated  AS-IS  antenna  to  block 
message  recepticm.  Such  a  Faraday  shield,  installed  while  the  missile  is  in  its  launch  tube, 
would  need  to  maintain  its  integrity  throu^iout  the  missile  ejecdmi  process  and  during  the 
flight  to  be  effective.  Finally,  it  must  be  keix  in  mind  that  any  successful  action  whatsoever 
to  drive  the  weaptm  into  the  ‘ENABLE*  state  acconqilishes  nothing  more  than  placing  one 
or  more  SLBM(s)  into  precisely  the  same  state  of  risk  that  all  SLBMs  are  presently  in 
today. 

B .  FORCING  AS-IS  INTO  THE  ^DISABLE*  STATE 

This  situation  arises  when  NCA  is  broadcasting  ‘ENABLE’  codes,  during  wartime 
or  in  various  states  of  higher  readiness,  and  the  aim  is  to  disable  one  or  more  missiles  by 
driving  it  into  the  ‘DISABLE’  state.  In  this  case,  any  measures  that  are  ‘destructive’  from  a 
systems  perspective  would  be  unproductive,  since  they  txily  drive  the  weapon(s)  into  the 
default  (i.e.,‘ENABLE’)  state.  Accordingly,  similar  oounteimeasuies  also  become  letevant 
when  the  weapon  is  initially  in  the  default  ‘ENABLE’  state.  A  large  set  of  such 
countermeasures  is  centered  around  local  (ot  even  global)  broadcast  of  false  NCA 
‘DISABLE’  transmissions  to  gain  control  of  the  AS-IS  channel  into  one  or  moie  modules. 
Such  approaches  typically  involve  decryption  of  tiie  AS-IS  messages  (see  Sectitm  in.C 
below).  Another  method  involves  playing  badt  earlier-recorded  valid  NC^  ‘DISABLE’ 
transmissitms  (see  Sectitm  IILD  below). 

C.  AS-IS  DECRYPTION  COUNTERMEASURES 

Attenqits  at  illegitimate  control  of  die  AS-IS  nxxlule  by  transmitting  sequoitial  or 
random  permutations  of  all  available  2S6-bit  message  codes  can  be  neglected;  the  ratio  of 
invalid  to  valid  codes  can  be  made  sufficiently  large  to  render  this  iqiproach  asynqittKically 


3  These  can  be  further  diminished  hy  a  sufficiently  deep  im^raikNi  of  the  AS-IS  ciicuiiiy  with  other 
critical  electronics  on  board  the  missile. 

*  In  princqiie,  this  antenna  Unk  potentially  provides  an  exposure  (rf  critical  imemalmissikelectiooics  to 

tlMiructive  EMP  bunts  in  wmttme  that  neoled  to  be  addressed  (e^.,  throuch  a  weak  acrificial  mema 

link). 
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Anxmg  genuine  decrypticm  efifotts,  code-breaking  is  likely  to  start  with  the  address 
bit-field  porticm  of  die  AS-IS  message  format  (see  Section  HB),  since  this  fragment  can  be 
identified  most  readily  in  the  NCA  transmissions.  To  add  significant  difficulty  to  that 
activity,  nonstationary  virtual  addresses  can  be  used.  This  is  distinct  frcnn  the  notitm  of 
changing  decryption  keys,  in  that  the  roving  virtual  address  does  not  directly  map  m  the 
physical  address:  it  merely  establishes  a  valid  domain  that  the  AS-IS  module  then  uses. 
The  physical  AS-IS  unit-address  is  factory-coded  and  held  cmly  within  the  tanqrerproof 
electronics  module.  Continually  changing  virtual  addresses  are  relayed  to  the  unit, 
decrypted,  and  ccMiqrared  to  die  current  virtual  address.  If  a  match  occurs,  a  virtual  address 
space  is  created  and  the  physical  address  is  m^iped  to  that  space.  If  the  physical  address 
lies  within  that  space,  the  action  sequence  portitm  of  the  message  is  subsequently  decoded 
and  acted  upon,  along  with  the  smrage  of  an  updated  virtual  address  and  decryptimi  key. 
The  purpose  of  multilevel  address  decoding  and  maintenance  of  virtual/physical  addresses 
is  to  ensure  that  a  high  level  of  message  security  is  maintained. 

D.  AS-IS  MESSAGE  PLAYBACK  COUNTERMEASURES 

Another  countermeasure  to  deal  with  the  encrypted  messages  is  to  record  NCA's 
'DISABLE*  broadcasts  during  peacetime  and  continually  play  diem  back  to  weiqions  sttxed 
in  a  shielded  envircmment^  To  deal  with  this  situation,  and  to  complicate  code-breaking 
activities,  a  moving  dectyptitm  key  is  prc^iosed.  The  key  required  to  decode  messages  on 
board  the  AS-IS  module  is  comprised  of  two  halves,  somewhat  analogous  to 
public^vate-key  systems.  One  pmtion  of  the  key  is  factory-installed  in  the  AS-IS 
module,  and  the  remainder  is  transmitted  along  with  the  authorizatitm  message  to  the 
module.  The  new  key  is  used  to  decrypt  the  next  message.  Since  message  receipt  occurs 
unpredictably,*^  the  key  remains  valid  up  to  the  next  valid  transmission.  After  use,  it  is 
replaced  by  the  new  key.  The  remotely  transmitted  key  is  a  member  of  a  set  of  valid  keys, 
and  is  deleted  from  that  set  once  used.  Hie  set  of  valid  keys  can  be  made  genuinely 
undepletable,  while  still  keeping  the  ratio  of  invalid  to  valid  keys  essentially  infinite  (see 
footnote  18).  Thus,  even  though  the  encryptitxi  of  messages  changes  on  a  cycle-by-cycle 


^  For  exanqrie,  if  AS-IS  is  ultimaidy  dqiloyed  in  10^  weapons,  more  ttan  10^®  invalid  codes  could  be 
made  to  exist  for  each  valid  message  sequence,  based  on  a  fuII2S6-bit  field.  Toputdiisinperqiective, 
sucb  a  brute  force  decryption  effort,  opai^  continuously  at  the  12S  kHz  AS-IS  bit  fiequeticy,  would 
on  avenge  lequiie  more  than  10  bUlioo  times  longer  dam  the  age  the  univene  to  stumble  onto  the 
correct  AS-IS  bit  sequence  for  a  pretkulv  we^xm. 

^  The  dighal  storage  required  by  such  a  system  is  not  great,  lequiiing  less  than  200  MBytes. 

^  SLBMsqrpically  wfll  not  begin  to  received  die  AS-B  transmissions  until  after  breakwater. 
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basis,  a  valid  key  can  successfully  decode  the  message  the  next  time  the  AS-IS  module 
receives  a  transmission,  even  though  multiple  keys  have  been  issued  in  the  interim. 

E.  AS-IS  MESSAGE  JAMMING 

Electronic  interference  or  deliberate  jamming  oftra  occurs  in  hostile  environments. 
In  the  context  of  AS-IS,  this  could  involve  either  uplink  jamming  directed  at  the  relay 
satellites,  or  downlink  jamming  directed  at  the  wej^n(s).  In  both  cases,  the  effect  is  to 
temporarily  interrupt  the  NCA  transmissions,  thereby  driving  the  AS-IS  module  into  its 
default  state.  In  the  SLBM  q>plicadon,  die  default  ‘ENABLE*  state  makes  jamming  aimed 
at  prohibiting  missile  launch  during  wartime  useless.  Jamming  is  thus  relevant  cuily  during 
peacetime  or  in  lower  levels  of  force  alert,  when  NCA  is  transmitting  ‘DISABLE*  codes. 
In  this  situation,  jamming  must  be  maintained  throughout  the  entire  missile  flight  to  block 
the  noodule  from  receiving  die  NCA*s  ‘DISABLE*  transmission.  Such  jamming  is  easily 
detectable,  and  its  effects  can  be  pracdcally  rerxx>ved  through  a  distributed  and  redundant 
transmission  and  relay  network.  Moreover,  as  noted  in  Section  in.A,  any  successful 
jarruning  effort  under  this  scenario  would  only  have  the  effect  of  leaving  NCA  without 
direa  control  over  the  SLBMs,  just  as  is  the  case  today. 

Jamming  aqipears  not  to  be  an  issue  in  the  SLBM  triplication;  however,  in  various 
tactical  irrrilementatitMis  of  AS-IS  (see  Secticxi  HLB)  this  is  not  die  case.  Such  iqiplicatiaiis 
typically  involve  a  default  ‘DISABLE*  state.  To  suppress  die  effects  of  jamming, 
techniques  such  as  filtering,  {duse  cancellation,  directional  antennae,  or  complex  digital 
signal  processing  are  often  invoked  singly  or  in  comlnnation.  While  many  of  these 
methods  are  effective  to  various  degrees,  they  are  often  slow,  cumbersome  to  inrilement, 
mission-limiting,  and/or  costly.  Although  a  conqilete  treatment  of  suppressim  techniques 
is  beyond  the  present  scope,  several  remarks  can  be  wwHft  relative  to  a  new  system  that 
warrants  consideration  for  AS-IS  jamming  suppression. 

A  system  that  reduces  the  adverse  effects  of  strtxig-anqilitude  interference*  has  been 
recently  studied  [4].  The  frequency-independent  strong  signal  suppressor  (FISSS)  uses  a 
sinqile  nonlinear-load  element  in  a  filter-type  circuit  Analogous  to  frequency-domain 
filtering,  the  circuit*s  transfer  diaracteristics  are  based  on  input  amplitude.  Large  amplitude 


*  If  ngnab  are  peaeat  that  are  nearer  below  the  MticipaiBd  level  of  the  AS-IS  carrier,  sinqde  techniques 
incioding  analog  filtering  may  be  qipropriaie. 
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signals  arc  nonlinearly  abscvhed  above  a  preset  threshold,  and  reflected  below  that 
threshold.  Preliminary  tests  in  the  range  of  relevant  frequencies  (1-10  GHz)  indicate  that 
FISSS  has  suppression  levels  from  20-60  dB,  and  that  digital  communication  signals  may 
be  reconstructed  after  FISSS  processing  tt>  produce  a  bit-error  rate  (BER)  of  ~  10^  as 
compared  to  a  BER  =  0.5  (unusable  noise)  without  FISSS.^  The  physical  bulk  of  a 
ccmnectnized  versirm  of  FISSS  is  small  (<  1  in^)  and  the  cost  is  anticipated  to  be  low. 
FISSS,  at  least  at  first  look,  appears  to  permit  certain  tactical  implementatitHis  of  AS-IS  to 
operate  with  an  onmidirectional  antenna^^  in  a  hostile  electronic  warfare  (EW) 
environment 


9  Hiis  level  of  integrity  (rf  one  inoomct  bit  per  thousand  correct  bitt  is  adequate  for  use  with  even  simple 

enor  correction  methods. 

A  diiectiooal  antenna  requires  sensitive  alignment  and  is  inqxactical  as  the  primary  receiver  element 
for  most  AS-IS  applications. 
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IV.  OTHER  AS-IS  IMPLEMENTATIONS 

A.  BASIC  TACTICAL  IMPLEMENTATIONS 

While  AS’IS  has  potential  in  exercising  ctmtinuing  authorizaticHi  over  nuclear  and 
strategic  weapois,  the  original  development  of  the  concept  was  aimed  at  the  control  of  non¬ 
nuclear  tactical  wei^XMis.  Applications  of  AS-IS  exist  for  any  tactical  system  that  relies  on 
sophisticated  electronics,  including  aircraft,  tanks,  missiles,  etc.  In  this  section,  the 
implementation  of  AS-IS  in  tactical  missiles,  with  ^)ecific  exan^les  given  for  man-portable 
surface-to-air  missiles  (SAMs)  and  anti-ship  missiles,  will  serve  to  illustrate  some  of  the 
general  concepts  involved.  Unilateral  implementation  of  AS-IS  into  tactical  weapons 
intended  for  FMS  and/or  FMA  is  examined.  Implications  of  these  fcv  various  fonns  of 
“short-term  diplcHnacy*’  are  also  discussed.  Multinatitmal  implementation  of  AS-IS  into 
tactical  weapons,  involving  several  or  all  of  the  major  arms  producing  and  applying 
naticMis,  would  involve  a  significant  degree  of  intematitmal  cooperation,  along  with  new 
treaties,  but  would  have  the  strongest  impact  on  the  problems  currently  posed  by 
uncontndled  proliferation. 

1.  Tactical  Weapon  Proliferation 

The  proliferation  of  high-threat  tactical  weapons,  including  anti-ship,  ground-to- 
ground,  and  surface-to-air  missiles,  including  nuui-portable  Stinger-class  SAMs,  poses 
risks  in  both  military  and  civilian  arenas.  The  civilian  secmr  is  particularly  threatened  by 
tenporist  groups  and  regimes,  while  the  military  secttn*  is  more  broadly  threatened.  In  the 
present  context,  a  “high-threat”  weapon  is  one  that  produces  a  high-kill  and/or  large 
casualty  count  per  weapon  dollar.  ^  For  this  reason,  these  weapons  often  occupy  a 
disproportionately  large  ftaction  of  the  arsenals  of  develping  Third  World  countries  and 
terrorist  grops,  relative  to  the  makeup  of  arsenals  of  established  regimes.  As  the 
guidanoe,  targeting,  and  countermeasure-avoidance  of  tactical  missiles  become  increasingly 


^  IntliecaseaftnDp(vtaiiciaftaiidcanien,thereq>ectivecounter-wei|)oasiqiesemlessdian0.1%(rf 
the  cost  of  the  tar^  In  rough  tenns,  a  $30,000  Stinger  bolds  a  $100  million  aiiciaft  at  ride,  whiles 
handful  (rf$l  million  Exooets  threaten  a  $S  billioo  aircraft  carrier. 
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st^histicated,  effective  countermeasure  systems  are  decreasing  in  availability.  Those  in  use 
are  often  multi-tiered,  and  hence  costly. 

The  inherent  lack  of  continuing  authorization  over  tactical  weapons  produced  by  a 
nation  creates  vulnerability  to  that  nation  due  to  unexpected  loss  or  theft  of  weapons,  or 
third  patty  arms  sales.  Another  situation  arises  when  a  formerly  friendly  regime  becomes 
hostile  and  threatens  to  use  weapons  procured  in  priOT  arms  sales  against  that  nation,  or  its 
allies  or  interests.  A  recent  exattqrle  of  the  latter  was  the  situation  in  the  Persian  Gulf,  with 
Iraq  using  tactical  weaprms  (e.g.,  SCUDs)  previously  supplied  by  the  Soviets.  Iraq  also 
“inherited”  numerous  allied  tactical  assets,  including  Raytheon  Patriot  S  AM-trackers,  when 
it  invaded  Kuwait  The  lack  of  benign  continuing  authorization  over  those  weapons 
prevents  them  from  being  rendered  harmless  by  the  producing  countries  which,  for  the 
above  cases,  were  the  Soviet  Union  and  United  States. 

Relative  to  strategic  weapons,  the  safeguards  afforded  tactical  weapons  ate 
tnitutnal.  The  general  PAL  concept  implenKnted  in  many  nuclear  weapons  has  not  been 
^rplied  to  tactical  weaptms.  Stingers  are  capable  of  being  armed  by  a  single  individual 
from  the  day  they  enter  the  operational  arena,  and  can  only  be  disarmed  with  physical 
access.  Minimal  studies  have  beat  conducted  relative  to  a  system  that  ditectly  parallels  the 
nuclear-PAL.  Systems  that  have  been  considered  relied  on  physical  access  to  grant 
authorization.  The  de  facto  dictum  appears  to  oiqrhasize  countermeasures  in  contrast  to 
retaining  any  degree  control  over  such  tactical  weapons. 

The  global  situation  has  dramatically  changed  in  the  last  2  years  or  so.  The 
apparent  end  of  the  Cold  War,  the  attendant  changing  national  alignmrots,  and  the  Persian 
Gulf  war  all  may  drive  bold  new  initiatives  geared  at  regulating  tactical  weapcms.  A  main 
driver  for  consideration  of  a  continuing  authorization  system  may  be  the  desire  to  decrease 
the  level  of  future  conflicts  diat  involve  heavy  use  of  externally  procured  we^xms.  It  may 
not  be  whdly  itieqxMisible  to  cemsider  die  possibili^  (tf  new  multilateral  initiatives  directed 
toward  establishing  some  measure  of  ctmtinuing  authorization  over  the  use  of  tactical 
weqxms.  Given  existing  stockpiles,  the  benefit  of  an  AS-IS  system  must  be  recognized  as 
being  ptedominandy  long-term. 

2.  AS-IS  Configuration  for  Tactical  Weapons 

A  suitable  exanqile  for  discussion  purposes  is  givoi  by  Stinger-type  shoulder-fired 
SAMs.  In  such  a  weapon,  the  iqipropriate  AS-IS  default  state  would  be  'DISABLE*. 
Reception  of  valid  NCA  transmissions  would  allow  use  of  the  weiqion.  In  this  case,  die 
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effect  of  electronic  jamming  to  drive  the  weapon  into  its  default  ‘DISABLE’  state  is  partly 
addressed  by  requiring  infrequent  message  receipt  (see  also  Secticm  HLE).  A  clock  internal 
to  the  AS-IS  module  within  the  missile  launch  tube  enables  the  receiver  and  decoding 
elecmxiics  to  detect  and  update  the  weapon’s  enable/disable  status  periodically  (e.g.,  every 
24  hours).  Ibis  period  could  readily  be  contracted  to  minutes,  or  extended  to  weeks, 
months,  or  beyond.  The  weapon  maintains  status  until  the  AS-IS  rrxxlule  “wakes  up’’  and 
listens  for  its  next  authorization  transmission.  To  disarm  a  weapon,  either  a  ‘DISABLE’ 
code  may  be  broadcast  for  immediate  effect,  or  the  we^>on  address  may  be  deleted  from 
the  NCA  authorized-use  list,  in  which  case  the  weq)on  will  be  enter  an  appropriate  disabled 
state  after  the  current  status  period  ejqrires. 

Operaticmal  ctmsidetations  demand  that  field  persoimel  need  a  capability  to  override 
the  internal  clock,  using  a  launcher  panel  switch,  to  allow  the  weapon  AS-IS  status  to  be 
updated  at  any  time.  If  this  action  is  taken,  the  internal  24-hour  clock  is  reset.  Current 
status  may  be  locked  in  by  field  personnel  fix'  a  24-hour  period  to  ensure  that  jamming  will 
have  no  effect  during  this  period.  This  constant-status  period  cannot  be  extended  without 
receiving  a  subsequent  status  update.  Through  such  periodic  updates,  the  service  life  of  the 
battery  is  also  extended  approximately  500  tirrres  relative  to  the  receiver  being  constantly 
enabled.  For  the  power  requirements  in  Section  n£,  a  relatively  small  5  amp-hr  lithium 
battery,  housed  in  the  launcher,  provides  nearly  10  months  continuous  service^  and  has  a 
S-year  shelf  life.  The  AS-IS  hardware  module  has  a  compact  and  inexpensive 
onanidirectitxial  antmna  inqrlemented  with  confixmal  microstrip  technology  in  die  launcher 
tube.  Even  for  relatively  small  tactical  weaptms,  such  as  Stinger-class  SAMs,  the  1  GHz 
carrier  wavelength  is  well  suited  to  an  integral  half-wave  dipole  antenna.  Requisite  signal 
processing  electronics  are  also  housed  in  the  weapon  or  its  launch  platform,  as  shown  in 
Figure  6. 

To  provide  confidence  to  the  soldier  in  the  field,  a  status-lock  switch  is  used  to  lock 
the  current  status  for  a  prescribed  period  of  time,  which  might  be  taken  to  be  equal  to  the 
required  message  receipt  interval,  or  24-hoors.  This  capability  permits  the  soldier  to 
predictably  operate  the  weapon  without  concern  that  it  may  be  disarmed  at  an  int^rportune 
time.  This  status-extension  feature  may  be  utilized  only  once  after  each  valid  authorization- 
code  receipt  At  any  time  the  weapon  operator  may  request  a  status  update  by  enabling  the 


2 


Higher  capacity,  or  additional  batteries,  could  be  used  to  extend  or  diminaiB  the  maintenance  cycle. 
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Launch  Tube 


Figur*  6.  AhlS  Concept:  Stingtr  Implwntntation 
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AS-IS  module  to  actively  listen  for  its  particular  code.  This  action  might  be  taken  when  a 
weapon  is  uncrated  and  removed  from  an  EM-shielded  environment. 

As  shown  in  Figure  6,  the  only  additional  external  features  to  the  weapon  system 
are  the  two  switches  noted  above  (to  request  status  update  and  to  lock  current  status)  and 
one  indicator  lamp  to  display  the  current  enabled/disabled  status  (e.g.,  green  = 
‘ENABLED’,  red  =  ‘DISABLED’).  Other  than  the  presence  of  the  two  switches  and  single 
indicatOT,  no  weapons  operator  actions  are  implied.  Essentially,  the  AS-IS  system  is 
passive,  and  only  requires  minimal  attention  from  the  operate.  Other  elements  such  as  an 
additional  visual  indicate  or  audible  buzzer  to  indicate  the  impending  termination  of  a 
24-hour  lockout  period,  as  well  as  a  feature  that  would  pennit  automatic  updating  of  cunent 
status  during  a  lockout  period,  and  extending  the  period  if  the  status  does  not  change, 
might  also  be  considered. 

3.  Implications  of  AS-IS-Configured  Tactical  Weapons 

AS-IS  provides  a  means  by  which  the  threat  level  of  certain  tactical  weapons  is 
reduced,  short  of  direct  disarmament.  To  have  a  wider  impact  through  multinational 
application  of  the  concept  to  a  sufficiently  large  percentage  of  weaptms  available  globally,  a 
number  of  diplomatic  and  political  issues  must  be  addressed.  Some  form  of  multinational 
treaty  ccmceming  the  implementation  of  the  AS-IS  concq)t  might  even  be  considered.  Such 
a  treaty  has  multiple  implications  to  arms  manufacturers:  not  only  must  they  accept  the 
AS-IS  concept,  they  also  have  to  establish  whether  AS-IS  provides  a  safer  weapons 
environment  that  could  drive  proliferation^  or  whether  it  is  restrictive,  reducing  the  output 
of  arms  manufacturers  in  the  signatory  nations.  Wetqwns  using  AS-IS  are  likely  to  vanish 
frx>m  terrorist  arsenals  and  regimes.  Does  this  imply  that  the  arms  market  for  tactical 
missiles  and  similar  weapons  simply  shifts  to  Third  Worid  and  other  suppliers  non-allied 
with  AS-IS  treaty  nations?  It  might,  but  certainly  the  volume  and  quality  of  the  weapons 
would  decrease,  with  an  increase  in  effective  countermeasures  against  those  weapons. 
Non-AS-IS  weapons  will  probably  use  a  lower  level  of  technology,  for  which  some 
countermeasures  exist. 

While  certain  issues  related  to  the  practical  utility  of  multinational  implementations 
of  AS-IS  in  weapons  for  FMS  remain  unclear,  an  important  and  nxrre  straightforward 
application  for  AS-IS  equipped  tactical  weapons  arises  in  FMA  situations  (e.g.,  the 


3  A  lower  criterion  may  be  established  for  sale  of  an  AS-IS  equipped  unit  versus  a  non-AS-IS  unit 
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Stingers  widely  believed  to  have  been  supplied  to  the  Afghan  mujaheddin).  Given  their 
functionality,  AS-IS-equipped  weapons  could  certainly  be  introduced  more  freely  to  help 
achieve  a  desired  outcome  in  local  or  regional  conflicts.  AS-IS,  in  such  situations,  offers  a 
potential  for  short-term  diplomacy.  The  capability  to  introduce  arms  to  an  unstable  arena 
for  short  term  use,  and  subsequently  render  the  arms  harmless,  is  attractive  in  certain 
situations.  AS-IS  offers  possibilities  for  convenient  short-term  weapon  deployment  to 
temporary  allies  (e.g.,  Iran  or  other  Gulf  nations  in  the  August  1990  Iraq  annexation  of 
Kuwait)  to  fortify  positions  that  would  otherwise  require  U.S.  or  allied  presence  to  control 
weaponry.  An  advantage  is  obtained  in  being  able  to  rapidly  increase  tonts  in  a  conflict 
theater,  through  a  leveraging  of  indigenous  human  assets.  Moreover,  AS-IS  equipped 
weapons  provide  an  added  degree  of  diplomatic  and  political  pressure  to  be  exerted  on 
users,  through  the  potential  for  temporarily  disabling  weapons,  or  else  simply  degrading 
their  functionality  (petiiaps  even  covertly),  to  weigh  the  favor  of  battle  in  a  desired 
directitm. 

B.  GPS-COUPLED  IMPLEMENTATIONS 

Closely  related  to  the  basic  tactical  implementations  listed  above,  when  coupled 
with  transmissions  from  GPS  satellites,  AS-IS  provides  for  several  entirely  new  aiul 
potentially  interesting  application  scenarios.  One  of  these  involves  tiie  creation  of  we^xxis 
for  FMS  or  FMA  purposes  having  geographic  specificity.  In  particular,  a  given  weapon 
could  be  made  to  function  within  the  confines  of  a  preprogrammed  set  of  GPS  coordinates. 
Such  weapons  might  thereby  be  functionally  restricted  to  largely  defensive  purposes  only. 
The  precision  with  which  the  AS-IS-coupled  passive  GPS  receiver  can  determine  the 
weapons  coordinates,  even  without  selective  availability,  would  allow  the  weapon  to  be 
restricted  to  work  within,  say,  the  borders  of  a  particular  country  or  a  particular  region.^ 
The  set  of  allowed  geographic  coordinates  could  even  be  reprogrammed  by  NCA  via  the 
AS-IS  charmel. 

Another  application  involves  coupling  GPS  and  AS-IS  for  protection  of  sea  power. 
For  example,  the  AS-IS  concept  can  applied  to  defend  against  anti-ship  missiles.  The  key 
difference  between  the  Stinger  implementation  and  the  anti-ship  missile  AS-IS  unit  is  the 
addition  of  a  GPS  and  second  receiver.  Although  it  is  anticipated  that  many  future 
weapcms  will  have  pre-existing  GPS  capability,  the  AS-IS  GPS  receiver  is  directly 
integrated  into  the  tamperproof  AS-IS  unit  The  GPS  signal  is  used  by  the  missile  to 


*  With  better  than  lOO^netcr  accuracy. 
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establish  a  current  position  and  direction  vector  (fiom  the  rate  of  change  of  position).  To 
protect  itself,  a  ship  may  routinely  broadcast  commands  using  a  low-power  signal 
transmitter  (extending  to  roughly  a  10-mile  radius)  to  prevent  incoming  missiles  ftom 
arming  themselves.  The  disarm  commands  rapidly  sequence  through  the  relevant  AS-IS 
unit  addresses  that  correspond  to  the  inbound  weapons.  In  general,  all  weapons  may  be 
assumed  to  pose  a  threat.  For  example,  if  10^  missiles  are  to  be  prevented  from 
nuiintaining  arm-status  within  a  10-mile  radius  finom  the  ship,  a  2-GHz  signal  will  ensure 
that  an  attacking  missile  would  disarm  itself  within  one-quarter  second,^  which  is  adequate 
for  all  known  missiles.^ 

Instead  of  discretely  addressing  all  posable  AS-IS  nxxlules,  a  ‘universal-disable* 
code  could  be  implemented.  This  would  require  the  broadcast  of  a  single  command  that  is 
recognized  by  all  AS-IS  equipped  units.  This  lessens  the  bandwidth  requirements  of  the 
system,  but  increases  the  burden  of  maintaining  security  of  die  universal  code.  The  format 
of  this  direct  ship-to-missile  omnidirectional  encrypted  broadcast  consists  of  a  disarm  (or 
arm-prevent)  command,  and  the  location  of  the  ship.  Upon  receipt  and  decryption  of  this 
broadcast,  the  missile  determines  whether  its  range  and  directionality  are  such  that  the 
missile  is  within  a  prescribed  range  of  die  broadcast  coordinates  and  if  the  velocity  vector 
intersects  those  coordinates  (i.e.,  the  missile  is  heading  toward  the  ship).  This  dual  check 
permits  missiles  to  be  launched  from  a  ship  that  is  actively  protecting  itself  against  hostile 
fire,  and  to  prevent  the  ship  from  inadvertently  disabling  other  authorized  missiles.  Thus, 
AS-IS  provides  for  the  immediate  inctqiacitaticHi  of  a  weapon  oidy  in  a  vicinity  of  a  U.S.  ot 
friendly  ship  when  that  asset  is  threatened 


^  Wont-case  scenario:  thefinalcodeinasequenceof  10^  S12-bit  codes  (256  AS-IS  lHts,2S6  encoded 
GPS  bits)  disarms  the  missile. 

^  A  Mach  2  missile  at  sea-level  acquires  the  signal  at  10  nautical  miles  and  then  travels  less  than  600 
feet  (one-tenth  of  a  nautical  mile)  Motedisan^g  itself. 
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V.  SUMMARY  AND  FUTURE  DIRECTIONS 

The  AS-IS  omcept  described  here  is  an  RPAL,  providing  (xmtinuing  authorization 
capability  for  advanced  electronic  systems.  The  concept  is  quite  general,  and 
implementations  have  been  identified  for  strategic,  tactical,  and  even  commercial 
applications.  AS-IS  is  structured  around  a  set  of  globally  transmitted  secure  action 
sequence  messages-continuously  sent  by  the  NCA  via  one-way  satellite  links-to  AS-IS 
receiver  modules  embedded  in  the  weiqxns  and  coupled  to  their  (m-board  arming/guidance 
circuitiy.  Individual  AS-IS  modules  have  unique  digital  addresses,  allowing  NCA  to  assert 
remote  control  or  even  remote  programmability  over  entire  classes  of  weqrons,  selected 
groups  of  weapons,  or  even  over  individual  fielded  weapmis.  No  knowledge  of  the 
weapon  or  launch  platform  locaticms  is  required.  The  AS-IS  units  are  receive-<Mily  and 
cannot  disclose  the  presence  of  the  weapon.  If  the  NCA  or  the  satellite  link  are 
compromised  in  any  way,  or  if  the  AS-IS  module  itself  is  tampered  with  or  fails  for  any 
reason,  the  we^Kui  defaults  to  an  appn^inatB  predetermined  functkmal  state. 

When  ccmfigured  for  SLBM  use,  AS-IS  iq>pears  to  provide  a  poumtiaUy  workable 
solution  for  the  tradititmal  objections  against  the  use  of  PALs  for  naval  nuclear  strategic 
weapons.  In  particular,  unlike  conventional  PALs,  the  AS-IS  ctmcqrt  fully  maintains  the 
autonmnous  launch  oqral^ty  of  the  SSBN  platform  during  wartime,  which  is  central  to  the 
submarine’s  primary  stabilizing  role  in  the  strategic  triad,  as  well  as  the  stealth 
characteristics  of  the  submarine  itself,  while  effectively  allowing  NCA  to  assert  cmitrol 
over  accidental  or  unauthorized  SLBM  launches  during  peacetime  or  in  lower  states  of 
force  readiness. 

Appendix  A  gives  a  number  of  additicmal  technical  features  of  the  AS-IS  CQncq>t 
Appendix  B  summarizes  a  Red  Team  Evaluatimi  of  the  ctmcept  The  Red  Team  agreed 
that,  m  technical  grounds  alcme,  the  AS-IS  concept  appears  feasible,  but  the  key  issue  cm 
which  further  consideration  of  AS-IS  hinges  is  the  suitability  of  current  Air  Force  PAL 
controls  for  naval  nuclear  missiles.  If  the  present  PAL  system  is  ctmsidered  insufficiently 
reliable  for  SLBM  use,  then  the  AS-IS  oonoq>t  may  warrant  fiirdier  consideration. 
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Develq)inent  of  the  AS-IS  system  is  continuing.  This  is  intended  to  lay  the 
foundation  for  serious  consideratimi  of  an  AS-IS  based  remote  continuing  authorizatitMi 
system  for  advanced  weapons. 
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APPENDIX  A 


THE  AS-IS  COMMUNICATIONS  CONCEPT 

Viewgraphs  from  a  Presentation  to  a  Red  Team  Convened  at  IDA 

February  19,  1992 
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POTENTIALLY  SUITED  FOR  CERTAIN  NARROW  NICHE  APPLI 

-  STRATEGIC  WEAPONS  CONTROL 

-  TACTICAL  WEAPONS  CONTROL 

-  NOVEL  COMMERCIAL  APPLICATIONS 
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300  meters  electrode  separation 


THE  GLOBAL  AS-IS  COMMUNICATIONS  LINK  I  OA 
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Active  Safing  and  Isolation  System  (AS*IS) 
RED  TEAM  EVALUATION 


I.  INTRODUCTION 

On  February  19, 1992,  the  Institute  for  Defense  Analyses  convened  to  discuss  the 
cornet  of  Active  Safing  and  Isolation  System  (AS-IS).  The  attendees  included  experts 
fiom  the  Department  of  Defense,  the  Central  Intelligence  Agency,  the  National  Security 
Agency,  The  National  Defense  University,  and  the  Institute  for  Defense  Analyses.^  The 
group  provided  a  Red  Team  evaluatkNi  of  the  AS-IS  ctmcept 

The  team  discussed  both  the  technical  feasilnlity  and  the  possible  applicatimi  of  AS- 
IS.  The  discussitHi  focused  primarily  on  the  merits  of  AS-IS  as  a  positive  control  system 
for  naval  nuclear  wei^rons,  but  briefly  touched  on  tactical  applications  of  the  system  as 
well.  The  group  agreed,  as  a  baseline,  to  leave  aside  the  issue  of  cost  in  any  detail,  but  did 
provide  some  general  comments  about  the  apparent  cost/benefit  trade-offs  of  the  concept 

The  present  authors  do  not  necessarily  agree  with  all  of  the  findings  of  the  Red 
Team  Evaluatimi  and  believe  that  many  are  nx>re  pessimistic  than  warranted.  For  the 
benefit  of  the  reader,  however,  a  summary  of  the  evaluation  is  presented  here. 

n.  RED  TEAM  EVALUATION 

A.  Summary 

Overall,  the  comments  from  the  Red  Team  were  wtfavorable.  While  most  of  the 
team  felt  that  the  AS-IS  concept  could  be  achieved  uchnically,  they  had  considerable 
concern  aboitt  the  a/^lication  and  reliaiHlity  of  the  system  —  both  in  peacetime  and  during 
hostilities.  As  a  positive  control  system  for  naval  nuclear  weapons,  AS-IS  seemed  to 
provide  little  real  benefit  aver  conveiaionai  PALs.  Nor  did  the  Red  Team  subscribe  to  the 
use  of  AS-IS  on  tactical  weapons.  So,  in  that  light,  the  full  costs  of  developing  the  system 
were  felt  to  outweigh  its  benefits. 


1  Auendeet  ndoded  Mr.  G«y  Beioaiiie  (OADS/ISP/SFP);  CAPT  GenM  Dunne.  USN  (DPB);  Dr. 
HauU  Retef  (IDAASED);  Dr.  JeOrey  Ofooe  (IDA/SFARD);  Dr.  Thomas  Julian  (NDUAX3tP);  Dr. 
SiBvea  KiMMr  (EDA/SATD);  Mr.  Bany  Levin  (ClA/OSWR);  Mr.  William  Marks  (NSA/V6);  Mr. 
John  Robeftaoa  GDA/SED);  CAPT  James  Tisantmi,  USN  (DKtAE/SATNF);  Mr.  Fred  Weraeks 
(C3AA)SWR);  Dr.  Howml  Wheoel  (IDA/SED). 
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B.  AS-IS  in  Brief 

AS-IS  deals  with  the  ability  to  control  a  weapon  once  it  is  sold,  deployed,  or 
launched.  The  system  began  as  an  idea  —  primarily  for  conventional  weapons,  such  as  the 
Stinger  missile  ~  for  safeguarding  weapons  that  are  sold  or  given  to  foreign  countries,  and 
might  later  fall  into  the  hands  of  adversaries. 

The  concept  grew  into  an  application  for  the  control  of  sea-launched  ballistic 
missiles  (SLBMs),  driven  by  a  renewed  interest  in  the  lack  of  an  appropriate  permissive- 
action  link  (PAL)  for  naval  nuclear  weapons.  Those  who  support  the  AS-IS  concept 
believe  that  it  is  a  bettor  mechanism  than  PALs  for  submarine  launched  weapons,  primarily 
because  of  its  minimal  intact  (xi  the  mission  and  operations  of  SLBMs:  it  does  not  divulge 
the  location  of  a  submarine;  it  does  not  use  a  con^licated  system  of  keys;  it  does  not  add  to 
sulnnarine  launching  operations;  and  it  preserves  the  physical  capability  of  the  SSBN  crew 
to  launch  a  strike  even  if  the  strategic  ctMiununication  systems  are  destroyed. 

The  overall  concept  is  a  simple  one.  AS-IS  broadcasts  ctxitrol  messages  to  SLBMs 
via  satellites,  with  no  prior  knowledge  of  their  location.  The  system  has  global  coverage 
and  could  be  used  to  intercqrt  an  unauthorized  ot  accidental  missile  launch.  AS-IS  relays  a 
message  to  arm  or  disarm  a  missile,  alter  its  trajectory,  or  deactivate  a  warhead,  after  the 
launched  missile  breaks  water.  The  AS-IS  system,  however,  does  not  prevent  a  missile 
from  being  launched.  The  satellites  receive  messages  from  the  National  Command 
Authority  (NCA).  In  practice  during  peacetime,  for  example,  the  satellite  would  send 
continuous  "disarm"  messages  to  SLBMs.  If  an  accidental  launch  occurred,  the  missile 
would  be  disarmed  or  diverted. 

C.  Red  Team  Assessment 

1.  PALs  versus  AS-IS 

If  a  policy  decision  is  made  to  employ  a  positive  control  system  on  SLBMs,  why 
use  AS-IS  instead  of  existing  PALs?  Like  other  nuclear  weapons,  subnuuines  receive  a 
signal  authorizing  the  launch  of  a  weapon.  In  the  past,  communications  to  submarines 
were  less  effective  than  to  land-based  missiles.  One  member  described  how  a  submarine 
often  had  to  piece  together  several  messages  to  come  up  with  a  valid  emergency  action 
message.  But  comminucatkHis  is  no  longer  a  problem.  It  was  explained  tiiat  the  same  PAL 
message  that  goes  to  the  Minuteman  goes  to  SLBMs.  On  the  submarine,  however,  the 
message  is  ignored  since  PALs  are  not  part  of  launch  procedures. 
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Furthermore,  it  was  asserted  that  the  notion  of  "compromising  SLBM  operations" 
-  as  presented  in  the  briefing  -  is  inaccurate.  There  are  many  arguments  against  most  of 
the  benefits  ascribed  to  AS-IS  as  compared  to  PALs.  One  member  went  on  to  say  that  the 
PAL  message  does  not  compromise  the  "stealth"  of  a  submarine.  The  PAL  message  is 
longer  and  harder  to  receive,  but  the  message  gets  through.  So  the  operational 
disadvantages  of  PALs  are  overstated. 

Another  member  added  that  procedures  already  exist  to  prevent  the  launch  of  an 
SLBM:  the  only  real  use  for  AS-IS  is  against  a  rogue  crew.  And  the  possibility  of 
conspiracy  is  very  low  --  crews  on  submarines  are  large  and  launch  procedures  are 
elaborate. 

So,  it  was  pointed  out,  the  issue  of  PALs  and  SLBMs  is  less  technical  than 
operational.  The  Navy's  biggest  problem  with  PALs  is  that  it  hangs  more  bells  and 
whistles  on  the  missile  that  the  Navy  wants.  Those  same  arguments  apply  to  AS-IS. 

Another  problem  was  raised.  AS-IS  requires  a  change  in  operational  procedures  on 
the  part  of  the  NCA.  In  wartime  it  depends  heavily  on  the  NCA  node.  With  AS-IS  the 
President  is  responsible  not  only  for  authorizing  the  launch  of  a  nuclear  weaptm,  but  also 
for  turning  off  the  satellite  -  ensuring  that  the  SLBMs  are  receiving  an  "enable"  message. 
It  was  pointed  oi  t  that,  like  PALs,  AS-IS  requires  a  positive  action  to  launch  a  weapon. 
He  argued  that  the  positive  actitm  has  simply  been  transferred  from  the  missile  site  to  the 
NCA. 

A  Red  Team  member  explained  diat  a  strength  of  strategic  systems  is  that  once  the 
emergency  action  message  is  received,  the  responsibility  for  launch  is  in  the  hands  of  the 
persons  in  the  submarine  or  the  silo,  who  are  trained  to  handle  the  decision.  AS-IS 
distributes  critical  elements  of  die  action  system  to  space  and  to  the  NCA.  The  NCA  is  not 
a  place  where  more  action  and  respcmsibility  should  be  placed.  This  could  confuse,  slow 
down  or  degrade  what  is  now  an  orderly  process.  If  an  emergency  action  message  gets 
garUed  in  die  current  system,  the  worst  outctmie  is  that  the  missile  does  not  get  fired.  Widi 
AS-IS  mistakes  could  be  more  cosdy,  the  vdiole  system  could  be  destroyed. 

In  addition,  it  was  suggested  that  AS-IS  could  lower  ctHifidence  on  board  the 
submarine  raising  the  uncertainty  as  to  whether  wetqxins  will  really  work  when  they 
need  to.  With  AS-IS,  part  of  the  control  lies  outside  the  system,  which  introduces 
vulnerability.  By  OHitrast,  a  PALs  system  has  work  arounds  that  have  been  learned  over 
long  periods  of  time,  in  case  of  failure.  It  was  added  that  AS-IS  takes  away  some  of  the 
commanding  (rfilcer’s  tesponsilnlity.  AS-IS  could  increase  the  probability  that  a  weapon 
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would  be  launched  in  a  situation  where  there  is  doubt  or  confusing  signals.  Now  there  is 
no  safety  net  for  mistakes  -  which  means  more  control. 

Given  the  experience  and  infrastructure  in  place  to  support  PALs,  it  seems  to  be  a 
simpler  solution  to  the  need  for  a  control  system  for  SLBMs.  AS-IS,  by  contrast,  would 
require  a  whole  new  set  of  procedures,  training,  and  infrastructure.  Moreover,  as  it  was 
pointed  out,  the  easiest  PAL  is  the  emergency  action  message  itself.  If  a  second  message  is 
introduced  ->  AS-IS  ~  it  gives  the  enemy  a  second  opportunity  to  disrupt  communicatitms. 

It  was  argued  that  positive  control  of  naval  nuclear  weaprais  is  a  small  problem.  As 
an  "assure  against"  device,  AS-IS  seems  flawed  and  may  in  fact  offer  little  improvement 
over  the  level  to  which  wetqxms  are  now  controlled.  In  addition,  a  more  effective  missile 
ctmtrol  device  should  provide  control  before  a  ttrissile  is  launched.  It  is  toward  that  sort  of 
system  that  resources  should  be  devoted.  For  now,  PALs  are  a  far  less  expensive 
altonative. 

2.  Exploiting  AS>IS 

a.  Tamper-proofing  and  reliability 

One  member  raised  the  question  of  tamper-proofing,  or  as  another  suggested 
tamper-resistance.  Several  members  agreed  that  any  system  put  on  a  missile  can  be  beaten 
by  technicians,  or  could  lead  to  a  less  reliable  missile.  Beating  the  lab  guys  is  very 
difficult.  So  a  ctMi^iracy  could  occur  with  or  without  the  system. 

And  while  the  Red  Team  generally  agreed  that  tamper-resistant  attributes  could  be 
added  to  the  system,  it  was  explained  that  the  tradeoff  in  reliability  is  unacceptable  to  the 
Navy.  In  a  submarine  force,  die  system  is  sinqile.  Simplicity  and  experience  lead  to 
reliability.  And  nothing  at  sea  is  new,  the  systrais  have  evolved.  The  D-S,  fw  example, 
does  not  have  that  much  new  technology.  AS-IS  adds  complexity  to  the  rocket.  It  is  not 
simply  a  matter  of  adding  a  chip  or  two:  it  means  adding  a  receiver,  a  crypto  system, 
antennae,  tamper  resistance,  etc.  Equipment  fails.  Adding  more  equipment  reduces 
reliability. 

Moreover,  die  informadon  presented  in  the  briefing  makes  it  difficult  to  evaluate 
how  reliable  AS-IS  is.  It  was  pointed  out  that  there  is  a  difference  between  the 
functkMnality  of  a  chip  and  an  end-to-end  process.  The  system  adds  complexity  and 
increases  the  number  of  failure  modes.  What  is  the  probability  of  failure;  how  many 


B-5 

UNCLASSIFIED 


UNCLASSIFIED 


failures  are  possible;  at  what  frequency?  This  information  is  critical  to  evaluating  the 
system. 

It  was  noted  that  everything  on  a  missile,  now,  is  required.  Reliability  tests  will  be 
the  Achilles  heel  for  this  program.  Adding  something  else  increases  the  failure  rate  and 
introduces  a  new  element  into  the  ciidcal  path.  For  example,  adding  leads  into  a  guidance 
assembly  is  a  very  weak  link.  Onboard  a  submarine,  crews  have  access  to  the  leads, 
increasing  the  probability  of  compromise.  It  was  added  that  the  antennae  can  be  disrupted 
by  bad  weatho:,  water,  or  any  number  of  other  factors.  So,  it  reduces  the  capability  to  shut 
down  a  missile  with  100  percent  reliability.  It  was  suggested  that  the  failure  rate  and 
reliability  of  AS-IS  needs  to  be  more  explicit  and  then  compared  with  some  other  form  of 
PALs,  to  calibrate  its  value. 

b.  Single-Point  to  Failure 

It  was  argued  that  a  significant  weakness  of  the  system  is  its  single  point  to  failure 
"  a  point  design  system  -  that  can  lead  to  problems,  whether  it  be  through  tampoing  or 
satellite  transmission.  This  sort  of  system  provides  incentives  to  others  to  find  the  point  to 
failure  ar^d  cut  it  off.  The  strategic  triad,  with  its  land,  sea,  and  air  based  legs,  was 
designed  to  avoid  a  single  point  of  failure.  And  in  each  system  there  have  been  failures,  so 
the  concept  of  the  triad  is  very  importanL 

c.  The  Satellite  Link 

A  question  was  raised  concerning  satellite  disruption.  How  far  can  satellite 
perfonnance  be  degraded  and  the  system  still  functitm?  What  is  the  perforroance  margin  of 
the  satellite?  And  while  the  system  is  conceived  primarily  to  prevent  an  unauthorized 
launch  during  peacetime,  it  is  still  necessary  to  consider  the  case  of  hostilities.  Arguably 
during  hostilities,  absolute  control  over  wetqxjns  is  more  important  than  during  peacetime. 

The  system  seems  quite  vulnerable  to  jarruning  or  to  overload  by  continuous 
broadcasting  ~  an  action  that  an  adversary  might  take  to  disrupt  the  system.  It  was  argued 
tiiat  over  time  an  adversary  can  determine  the  power,  sequence,  and  frequency  of  the  AS-IS 
message  and  can  jam  the  system  with  noise.  Once  the  system  is  defeated,  positive  control 
is  lost  K*  an  adversary  can  demonstrate  loss  of  control,  the  value  of  the  system  is  degraded 
and  the  NCA's  confidence  in  controlling  weapons  is  undermined.  The  system  is  not  an 
end  game.  And  the  scenario,  while  political,  is  a  realistic  one. 


B-6 

UNCLASSIFIED 


UNCLASSIFIED 


Moreover,  the  argument  that  if  the  satellite  fails,  the  situation  reverts  m  the  "status 
quo"  is  flawed.  The  default  mode  of  the  system  is  overemphasized.  A  positive  control 
system  is  implemented  in  response  to  a  need.  Once  implemented,  the  "status  quo" 
changes.  So  if  the  system  fails  or  is  disrupted,  positive  control  is  lost;  it  is  impossible  to 
return  to  the  previous  status  quo. 

It  was  added  that  if  the  United  States  thought  that  the  former  Soviet  Union  had  a 
similar  system,  die  United  States  would  be  willing  to  spend  a  lot  of  money  trying  to  exploit 
it.  Furthenmne,  it  seems  hard  to  imagine  that  the  President  would  actually  allow  AS-IS  to 
be  included  in  a  package  of  shared  (i.e.,  multinational)  control. 

3.  Launch  Detection 

The  question  of  launch  detection  was  raised.  Since  the  system  does  not  intercept 
the  missile  until  after  breakwater,  it  is  possible  that  the  launch  might  be  detected.  If  so,  it 
creates  uncertainly  that  could  lead  to  false  retaliation.  If  the  system  does  not  prevent 
launch,  it  does  not  buy  enough.  It  was  aigued  that  it  is  most  likely  that  the  missile  will  not 
be  intercepted  until  after  the  first  stage  motw  launch,  increasing  the  probability  of  the  being 
launch  being  detected  by  others. 

4.  Operational  Concerns 

Several  operational  issues  were  raised. 

•  How  are  operational  tests  performed?  If  AS-IS  is  embedded  in  existing 
circuitry,  the  circuitry  needs  to  be  tested  after  routine  maintenance.  It  was 
added  that  to  adequately  test  the  system,  realistic  messages  need  to  be 
generated.  How  can  the  system  be  tested  and  replaced  securely? 

•  What  about  the  need  to  fire  a  missile,  on  short  notice,  because  of  an  accident  or 
fire? 

•  How  can  AS-IS  address  individual  missiles  when  the  targeting  is  not 
predetermined?  The  ability  to  separately  address  individual  weapons  is  an 
interesting  attribute  of  AS-IS,  not  available  within  the  current  system.  But 
nussiles  are  located  in  one  of  24  tubes,  the  targeting  of  which  is  not 
predetermined.  So  the  tube-to-target  relationship  can  be  changed  at  any  time. 
The  NCA  would  not  know  the  missile  patch,  and  therefore  which  missile  to 
disarm.  It  would,  in  theory,  be  very  interesting  to  be  able  to  turn  off  all 
missiles  targeted  at  Moscow,  but  without  the  missile  patch,  how  would  this  be 
operationaUy  possible? 
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A  further  complexity  was  added.  Submarines  rotate  as  well  as  missiles.  So  target 
packages  shift  not  only  among  missiles,  but  also  among  ships.  Turning  off  a  specific 
missile  seems  technically  possible,  but  how  the  system  knows  whether  it  is  the  right 
missile  is  in  question. 

5.  System  Security 

The  issue  of  security  was  raised.  When  eight  satellites  transmit  24  hours  a  day, 
security  is  an  issue  --  far  more  so  than  with  a  system  that  transmits  less  frequently.  As  a 
result,  AS-IS  has  the  potential  to  be  less  secure  that  the  system  in  place  today. 

One  member  also  cautioned  about  the  use  of  public  and  private  keys  with  respect  to 
system  security.  While  it  might  be  interesting  to  explore  the  use  of  a  public^vate  system, 
it  has  drawbacks.  It  was  added  that  public/private  keys  are  not  sufficiently  secure.  Having 
part  of  the  message  publicly  available  simplifies  decryption.  So  the  system  needs  a  proven, 
secure  key. 

It  was  argued  that  time  stamps  may  also  lower  security.  The  time  stamp  introduces 
a  commonalty  between  messages.  And  it  changes  in  a  predetermined  manner,  so  the 
messages  are  not  entirely  independent  These  aspects  add  a  "hook"  that  can  facilitate 
decryption. 

6.  Tactical  and  Other  Applications 

Few  members  of  the  Red  Team  supported  the  use  of  AS-IS  for  tactical  applications, 
except  for  the  possibility  of  very  limited  applications.  It  was  pointed  out  that  the  system 
imposes  an  additional  burden  on  potential  buyers  that  would  make  U.S.  weapons  very 
unattractive.  FurthermOTe,  there  is  the  problem  of  accounting  for  weapons  —  knowing 
where  systems  are  and  figuring  out  which  systems  to  enable  or  disable.  The  worid  is  very 
complex  and  the  problem  is  not  a  single  one. 

Important  also  are  the  political  costs  of  tactical  applications.  If  the  United  States 
puts  AS-IS  on  tactical  weapons  that  are  sold  abroad,  it  implies  some  level  of  responsibility 
on  the  part  of  the  United  States  over  the  use  of  the  weapons.  If  the  weapons  are  used  or 
there  is  an  accident,  the  United  States  becomes  the  responsible  actor,  at  least  in  part  ~  for 
not  having  the  system  disabled  -  rather  than  whoever  had  control  of  the  weapon.  The 
United  States  is  effectively  inserted  into  any  conflict  in  which  the  weaptms  are  used. 

Sevoal  operational  problems  that  might  arise  during  hostilities  were  also  raised. 
Cellular  transmittos  that  send  the  signal  to  tactical  weapons  can  be  easily  shot  down. 
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rendering  them  unable  to  transmit  an  "enable"  message  to  the  weapons.  It  is  a  single  point 
to  failure:  ifthr  Tansmitters  are  knocked  out,  the  weapon  is  knocked  out.  And  even  if  the 
system  can  be  ’  *ocked"  into  enable  status,  it  is  one  additional  requirement  for  the  infantry 
during  high  stress  situatitMis.  Things  go  wrong  all  the  time;  the  most  common  mistake  is  to 
forget  the  batteries  for  the  radio.  So  the  system  inserts  doubt  into  the  mind  of  an  infantry 
person  —  already  being  asked  to  do  a  very  difficult  job  --  as  to  whether  the  weapon  will  fire 
when  needed.  Moreover,  "enabled"  weapons  can  still,  during  conflict,  get  into  the  hands 
of  the  enemy  and  be  used. 

Some  member  of  the  Red  Team  did  raise  limited  applications  of  AS-IS.  It  was 
suggested  that  tactical  applications  may  offer  an  opportunity  for  covert  emplacement.  It 
was  noted  that  AS-IS  technology  may  have  applications  in  conjunction  with  new  satellite 
capabilities  that  will  enable  a  few  satellites  to  communicate  throughout  the  world.  Or,  as 
was  also  mentioned,  AS-IS  type  technology  might  be  used  with  GPS  to  control  activity  in  a 
given  region  of  the  world.  One  member  noted  that  the  concept  has  merit  as  a  remote 
satellite  launching  system,  with  possible  use  in  broader  applications.  Another  member 
added  the  use  of  AS-IS  for  IFF,  or  periiaps  with  high-value  commercial  products. 

7.  Cost 

While  cost  was  not  a  central  theme,  many  members  of  the  Red  Team  cautioned 
against  expressing  costs  in  hardware  terms  only.  A  more  realistic  assessment  of  cost  must 
include  the  range  of  system  development  and  maintenance  costs  --  development,  testing, 
evaluation,  training,  infrastructure,  hardware,  operational  maintenance,  and  suppon.  And 
these  costs  need  to  be  compared  to  other  alternatives,  namely  existing  PAL  systems  or 
taking  no  action  at  all,  in  order  to  be  credible. 

As  one  member  noted,  controlling  SLBMs  is  a  low  level  problem,  for  now.  A 
simple,  elegant,  low-cost  system  is  needed.  AS-IS  is  not  that.  So  it  is  hard  to  support  the 
system  from  a  policy  perspective.  Furthermore,  it  was  pointed  out  that  it  does  not  seem 
useful  to  add  high  costs  to  solve  a  peacetime  problem  with  a  method  that  might  prove  to  be 
worrisome  during  hostilities. 

8.  Other  Comments 

a.  Bandwidth 

The  group  spent  some  time  discussing  bandwidth.  One  member  noted  that  the 
bandwidth  for  AS-IS  was  greater  than  for  ELF.  It  was  also  suggested  that  the  AS-IS 
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concept  might  have  a  communication  advantage  over  ELF,  in  that  a  more  complicated 
message  can  be  sent  than  through  ELF.  But  concern  was  expressed  over  the  pracdcal 
throughput  needs  of  the  system.  Transmission  rates  for  AS-IS  will  be  high,  so  it  may  be 
difficult  to  get  the  needed  bandwidth. 

b.  Error  Rates 

During  the  discussion  of  bit  error  rates  for  digital  coding  schemes,  it  was  suggested 
that  the  error  rates  be  compared  to  the  current  NAVSAT  system.  Unless  the  signal  is 
stronger  than  NAVSAT,  it  will  not  get  through.  The  comparison  provides  a  useful  frame 
of  reference  for  evaluation. 

It  was  also  mentioned  that  clock  synchronizadon  has  long  been  a  difficult  problem 
in  commurucadons. 

III.  SUMMARY  OF  AUTHORS'  VIEWS 

Most  of  the  Red  Team  discussions  dealt  with  the  reladve  merits  of  the  existing  PAL 
controls  over  the  proposed  AS-IS  concept.  There  was  uniform  agreement  that,  if  the 
commurucadons  required  in  the  PAL  system  currenUy  in  place  for  controlling  Air  Force 
nuclear  missiles  are  deemed  reliable  enough  for  submarine  applicadon,  then  that  system  is 
clearly  the  simpler  and  more  cost-effective  solution.  In  fact,  AS-IS  was  proposed  solely  to 
deal  with  the  scenario  in  which  the  existing  PAL  is  assumed  to  be  insufficiendy  reliable  fw 
SLBM  use.  Under  the  existing  PAL,  the  emergency  action  message  must  successfully 
reach  the  launch  site  -  presumably  under  electronic  warfare  conditions  -  in  order  for  the 
missile  to  be  launched.  Under  the  AS-IS  proposal,  communicatims  must  reach  the  missile 
only  during  peacetime,  when  DISABLE  signals  are  being  transmitted  by  the  NCA.  During 
wartime,  when  communications  are  less  reliable,  no  cotiununication  with  the  missile  is 
needed  to  permit  launch. 

There  was  general  agreement  that,  on  technical  grounds  alone,  the  AS-IS  concept 
appears  to  be  feasible.  Certain  operational  issues  raised  by  the  Red  Team  do  warrant 
serious  consideration.  However,  the  key  issue  on  which  further  consideration  of  AS-IS 
hinges  is  the  suitability  of  the  current  PAL  controls.  If  the  present  PAL  system  is 
considered  insufficiently  reliable  for  SLBM  use,  the  AS-IS  concept  may  warrant  further 
study. 
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